diff --git a/docs/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/docs/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 0bd0562745e..8dfc8c2daf1 100644
--- a/docs/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/docs/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -141,7 +141,8 @@ You need to remove the following components from Rancher-provisioned RKE2 nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing RKE2
@@ -165,7 +166,8 @@ You need to remove the following components from Rancher-provisioned K3s nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing K3s
diff --git a/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md b/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md
deleted file mode 100644
index 50f39dcc1dc..00000000000
--- a/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Kubernetes Security Best Practices
----
-
-
-
-
-
-## Restricting Cloud Metadata API Access
-
-Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets.
-
-It is advised to consult your cloud provider's security best practices for further recommendations and specific details on how to restrict access to cloud instance metadata API.
-
-Further references: MITRE ATT&CK knowledge base on - [Unsecured Credentials: Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/).
diff --git a/docs/reference-guides/rancher-security/rancher-security.md b/docs/reference-guides/rancher-security/rancher-security.md
index 5d9ece208e7..9e55bb94d64 100644
--- a/docs/reference-guides/rancher-security/rancher-security.md
+++ b/docs/reference-guides/rancher-security/rancher-security.md
@@ -41,9 +41,7 @@ For details, refer to the section on [security scans](../../how-to-guides/advanc
`
## SELinux RPM
-[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.
-
-We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux` and `rke2-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).
+We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux`, `rke2-selinux` and `k3s-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).
## Rancher Hardening Guide
@@ -80,8 +78,39 @@ Rancher is committed to informing the community of security issues in our produc
## Kubernetes Security Best Practices
-For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](kubernetes-security-best-practices.md) guide.
+For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Cluster Security Best Practices](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/) guide.
## Rancher Security Best Practices
For recommendations on securing your Rancher Manager deployments, refer to the [Rancher Security Best Practices](rancher-security-best-practices.md) guide.
+
+## Rancher Kubernetes Distributions (K3s/RKE2) Self-Assessment and Hardening Guides
+
+Rancher uses the following Kubernetes distributions:
+
+- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector.
+- [**K3s**](https://docs.k3s.io/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory requirement of upstream Kubernetes, all in a binary of less than 100 MB.
+
+To harden a Kubernetes cluster that's running a distribution other than those listed, refer to your Kubernetes provider's docs.
+
+### Hardening Guides and Benchmark Versions
+
+Each self-assessment guide is accompanied by a hardening guide. These guides were tested alongside the listed Rancher releases. Each self-assessment guide was tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can use the existing guides until a guide for your version is added.
+
+### RKE2 Guides
+
+| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide |
+|------|--------------------|-----------------------|-----------------------|------------------|
+| Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+
+### K3s Guides
+
+| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide |
+|------|--------------------|-----------------------|-----------------------|------------------|
+| Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
diff --git a/docs/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md b/docs/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md
new file mode 100644
index 00000000000..e74ee2c20e0
--- /dev/null
+++ b/docs/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md
@@ -0,0 +1,13 @@
+---
+title: About k3s-selinux
+---
+
+
+
+
+
+`k3s-selinux` provides policies for K3s. It is installed automatically when the K3s installer script detects that it is running on an RPM-based distro.
+
+The `k3s-selinux` GitHub repository is [here](https://github.com/rancher/k3s-selinux).
+
+For more information about installing K3s on SELinux-enabled hosts, see the [K3s documentation](https://docs.k3s.io/advanced#selinux-support).
\ No newline at end of file
diff --git a/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
index 2a9adf1e4f2..b3be3dade1c 100644
--- a/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+++ b/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
@@ -16,7 +16,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
-The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
+The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
:::
@@ -24,19 +24,6 @@ The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
Set up the yum repo to install `rancher-selinux` directly on all hosts in the cluster.
-In order to use the RPM repository, on a CentOS 7 or RHEL 7 system, run the following bash snippet:
-
-```
-# cat << EOF > /etc/yum.repos.d/rancher.repo
-[rancher]
-name=Rancher
-baseurl=https://rpm.rancher.io/rancher/production/centos/7/noarch
-enabled=1
-gpgcheck=1
-gpgkey=https://rpm.rancher.io/public.key
-EOF
-```
-
In order to use the RPM repository, on a CentOS 8 or RHEL 8 system, run the following bash snippet:
```
@@ -71,14 +58,14 @@ Install the RPM:
yum -y install rancher-selinux
```
-## Configuring the Logging Application to Work with SELinux
+## Configuring the Logging and Monitoring Applications to Work with SELinux
:::note Requirement:
-Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9.
+Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
-To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart.
+To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
diff --git a/docs/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md b/docs/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
index 75df1de0d00..7d079c18300 100644
--- a/docs/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
+++ b/docs/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
@@ -10,11 +10,14 @@ title: SELinux RPM
Developed by Red Hat, it is an implementation of mandatory access controls (MAC) on Linux. Mandatory access controls allow an administrator of a system to define how applications and users can access different resources such as files, devices, networks and inter-process communication. SELinux also enhances security by making an OS restrictive by default.
-After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. To check whether SELinux is enabled and enforcing on your system, use `getenforce`:
+After being historically used by government agencies, SELinux is now an industry standard and enabled by default on SUSE distributions such as SUSE Linux Enterprise 16, openSUSE distributions such as openSUSE Tumbleweed, and RHEL-based OS such as Rocky Linux. To check whether SELinux is enabled and enforced on your system, use `getenforce`:
```
# getenforce
Enforcing
```
-We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: [`rancher-selinux`](about-rancher-selinux.md) and [`rke2-selinux`](about-rke2-selinux.md).
\ No newline at end of file
+We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts:
+- [`rancher-selinux`](about-rancher-selinux.md)
+- [`rke2-selinux`](about-rke2-selinux.md)
+- [`k3s-selinux`](about-k3s-selinux.md)
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index a2d3d658629..cd96b8d1f39 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -137,7 +137,8 @@ For instructions on cleaning nodes in RKE2 clusters that weren't deployed by Ran
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 RKE2
@@ -161,7 +162,8 @@ sudo rke2-uninstall.sh
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 K3s
diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 369a7be6f29..3f14c70d994 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -196,7 +196,8 @@ For instructions on cleaning nodes in RKE2 clusters that weren't deployed by Ran
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 RKE2
@@ -220,7 +221,8 @@ sudo rke2-uninstall.sh
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 K3s
diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index c7d0b7a028b..1387ebf8938 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -196,7 +196,8 @@ For instructions on cleaning nodes in RKE2 clusters that weren't deployed by Ran
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 RKE2
@@ -220,7 +221,8 @@ sudo rke2-uninstall.sh
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 K3s
diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index a2d3d658629..cd96b8d1f39 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -137,7 +137,8 @@ For instructions on cleaning nodes in RKE2 clusters that weren't deployed by Ran
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 RKE2
@@ -161,7 +162,8 @@ sudo rke2-uninstall.sh
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 K3s
diff --git a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 0f51db0c5da..6c4bcfb2c94 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -196,7 +196,8 @@ For instructions on cleaning nodes in RKE2 clusters that weren't deployed by Ran
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 RKE2
@@ -220,7 +221,8 @@ sudo rke2-uninstall.sh
要删除 rancher-system-agent，请运行 [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) 脚本：
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### 删除 K3s
diff --git a/sidebars.js b/sidebars.js
index 788832fb2bf..4f54bb715f1 100644
--- a/sidebars.js
+++ b/sidebars.js
@@ -1033,9 +1033,9 @@ const sidebars = {
items: [
"reference-guides/rancher-security/selinux-rpm/about-rancher-selinux",
"reference-guides/rancher-security/selinux-rpm/about-rke2-selinux",
+ "reference-guides/rancher-security/selinux-rpm/about-k3s-selinux",
],
},
- "reference-guides/rancher-security/kubernetes-security-best-practices",
"reference-guides/rancher-security/rancher-security-best-practices",
"reference-guides/rancher-security/security-advisories-and-cves",
"reference-guides/rancher-security/psa-restricted-exemptions",
diff --git a/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 2ed1d943849..a26e9796c8b 100644
--- a/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/versioned_docs/version-2.10/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -200,7 +200,8 @@ You need to remove the following components from Rancher-provisioned RKE2 nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing RKE2
@@ -224,7 +225,8 @@ You need to remove the following components from Rancher-provisioned K3s nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing K3s
diff --git a/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 2ed1d943849..a26e9796c8b 100644
--- a/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/versioned_docs/version-2.11/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -200,7 +200,8 @@ You need to remove the following components from Rancher-provisioned RKE2 nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing RKE2
@@ -224,7 +225,8 @@ You need to remove the following components from Rancher-provisioned K3s nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing K3s
diff --git a/versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 0bd0562745e..116df3c602a 100644
--- a/versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -141,7 +141,8 @@ You need to remove the following components from Rancher-provisioned RKE2 nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing RKE2
@@ -165,7 +166,8 @@ You need to remove the following components from Rancher-provisioned K3s nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing K3s
diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/kubernetes-security-best-practices.md b/versioned_docs/version-2.12/reference-guides/rancher-security/kubernetes-security-best-practices.md
deleted file mode 100644
index 50f39dcc1dc..00000000000
--- a/versioned_docs/version-2.12/reference-guides/rancher-security/kubernetes-security-best-practices.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Kubernetes Security Best Practices
----
-
-
-
-
-
-## Restricting Cloud Metadata API Access
-
-Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets.
-
-It is advised to consult your cloud provider's security best practices for further recommendations and specific details on how to restrict access to cloud instance metadata API.
-
-Further references: MITRE ATT&CK knowledge base on - [Unsecured Credentials: Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/).
diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security.md b/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security.md
index 5d9ece208e7..9e55bb94d64 100644
--- a/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security.md
+++ b/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security.md
@@ -41,9 +41,7 @@ For details, refer to the section on [security scans](../../how-to-guides/advanc
`
## SELinux RPM
-[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.
-
-We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux` and `rke2-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).
+We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux`, `rke2-selinux` and `k3s-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).
## Rancher Hardening Guide
@@ -80,8 +78,39 @@ Rancher is committed to informing the community of security issues in our produc
## Kubernetes Security Best Practices
-For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](kubernetes-security-best-practices.md) guide.
+For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Cluster Security Best Practices](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/) guide.
## Rancher Security Best Practices
For recommendations on securing your Rancher Manager deployments, refer to the [Rancher Security Best Practices](rancher-security-best-practices.md) guide.
+
+## Rancher Kubernetes Distributions (K3s/RKE2) Self-Assessment and Hardening Guides
+
+Rancher uses the following Kubernetes distributions:
+
+- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector.
+- [**K3s**](https://docs.k3s.io/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory requirement of upstream Kubernetes, all in a binary of less than 100 MB.
+
+To harden a Kubernetes cluster that's running a distribution other than those listed, refer to your Kubernetes provider's docs.
+
+### Hardening Guides and Benchmark Versions
+
+Each self-assessment guide is accompanied by a hardening guide. These guides were tested alongside the listed Rancher releases. Each self-assessment guide was tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can use the existing guides until a guide for your version is added.
+
+### RKE2 Guides
+
+| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide |
+|------|--------------------|-----------------------|-----------------------|------------------|
+| Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+
+### K3s Guides
+
+| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide |
+|------|--------------------|-----------------------|-----------------------|------------------|
+| Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md
new file mode 100644
index 00000000000..e74ee2c20e0
--- /dev/null
+++ b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md
@@ -0,0 +1,13 @@
+---
+title: About k3s-selinux
+---
+
+
+
+
+
+`k3s-selinux` provides policies for K3s. It is installed automatically when the K3s installer script detects that it is running on an RPM-based distro.
+
+The `k3s-selinux` GitHub repository is [here](https://github.com/rancher/k3s-selinux).
+
+For more information about installing K3s on SELinux-enabled hosts, see the [K3s documentation](https://docs.k3s.io/advanced#selinux-support).
\ No newline at end of file
diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
index 2a9adf1e4f2..b3be3dade1c 100644
--- a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+++ b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
@@ -16,7 +16,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
-The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
+The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
:::
@@ -24,19 +24,6 @@ The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
Set up the yum repo to install `rancher-selinux` directly on all hosts in the cluster.
-In order to use the RPM repository, on a CentOS 7 or RHEL 7 system, run the following bash snippet:
-
-```
-# cat << EOF > /etc/yum.repos.d/rancher.repo
-[rancher]
-name=Rancher
-baseurl=https://rpm.rancher.io/rancher/production/centos/7/noarch
-enabled=1
-gpgcheck=1
-gpgkey=https://rpm.rancher.io/public.key
-EOF
-```
-
In order to use the RPM repository, on a CentOS 8 or RHEL 8 system, run the following bash snippet:
```
@@ -71,14 +58,14 @@ Install the RPM:
yum -y install rancher-selinux
```
-## Configuring the Logging Application to Work with SELinux
+## Configuring the Logging and Monitoring Applications to Work with SELinux
:::note Requirement:
-Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9.
+Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
-To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart.
+To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
index 75df1de0d00..7d079c18300 100644
--- a/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
+++ b/versioned_docs/version-2.12/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
@@ -10,11 +10,14 @@ title: SELinux RPM
Developed by Red Hat, it is an implementation of mandatory access controls (MAC) on Linux. Mandatory access controls allow an administrator of a system to define how applications and users can access different resources such as files, devices, networks and inter-process communication. SELinux also enhances security by making an OS restrictive by default.
-After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. To check whether SELinux is enabled and enforcing on your system, use `getenforce`:
+After being historically used by government agencies, SELinux is now an industry standard and enabled by default on SUSE distributions such as SUSE Linux Enterprise 16, openSUSE distributions such as openSUSE Tumbleweed, and RHEL-based OS such as Rocky Linux. To check whether SELinux is enabled and enforced on your system, use `getenforce`:
```
# getenforce
Enforcing
```
-We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: [`rancher-selinux`](about-rancher-selinux.md) and [`rke2-selinux`](about-rke2-selinux.md).
\ No newline at end of file
+We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts:
+- [`rancher-selinux`](about-rancher-selinux.md)
+- [`rke2-selinux`](about-rke2-selinux.md)
+- [`k3s-selinux`](about-k3s-selinux.md)
diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/kubernetes-security-best-practices.md b/versioned_docs/version-2.13/reference-guides/rancher-security/kubernetes-security-best-practices.md
deleted file mode 100644
index 50f39dcc1dc..00000000000
--- a/versioned_docs/version-2.13/reference-guides/rancher-security/kubernetes-security-best-practices.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Kubernetes Security Best Practices
----
-
-
-
-
-
-## Restricting Cloud Metadata API Access
-
-Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets.
-
-It is advised to consult your cloud provider's security best practices for further recommendations and specific details on how to restrict access to cloud instance metadata API.
-
-Further references: MITRE ATT&CK knowledge base on - [Unsecured Credentials: Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005/).
diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/rancher-security.md b/versioned_docs/version-2.13/reference-guides/rancher-security/rancher-security.md
index 5d9ece208e7..9e55bb94d64 100644
--- a/versioned_docs/version-2.13/reference-guides/rancher-security/rancher-security.md
+++ b/versioned_docs/version-2.13/reference-guides/rancher-security/rancher-security.md
@@ -41,9 +41,7 @@ For details, refer to the section on [security scans](../../how-to-guides/advanc
`
## SELinux RPM
-[Security-Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.
-
-We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux` and `rke2-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).
+We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts: `rancher-selinux`, `rke2-selinux` and `k3s-selinux`. For details, see [this page](selinux-rpm/selinux-rpm.md).
## Rancher Hardening Guide
@@ -80,8 +78,39 @@ Rancher is committed to informing the community of security issues in our produc
## Kubernetes Security Best Practices
-For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](kubernetes-security-best-practices.md) guide.
+For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Cluster Security Best Practices](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/) guide.
## Rancher Security Best Practices
For recommendations on securing your Rancher Manager deployments, refer to the [Rancher Security Best Practices](rancher-security-best-practices.md) guide.
+
+## Rancher Kubernetes Distributions (K3s/RKE2) Self-Assessment and Hardening Guides
+
+Rancher uses the following Kubernetes distributions:
+
+- [**RKE2**](https://docs.rke2.io/) is a fully conformant Kubernetes distribution that focuses on security and compliance within the U.S. Federal Government sector.
+- [**K3s**](https://docs.k3s.io/) is a fully conformant, lightweight Kubernetes distribution. It is easy to install, with half the memory requirement of upstream Kubernetes, all in a binary of less than 100 MB.
+
+To harden a Kubernetes cluster that's running a distribution other than those listed, refer to your Kubernetes provider's docs.
+
+### Hardening Guides and Benchmark Versions
+
+Each self-assessment guide is accompanied by a hardening guide. These guides were tested alongside the listed Rancher releases. Each self-assessment guide was tested on a specific Kubernetes version and CIS benchmark version. If a CIS benchmark has not been validated for your Kubernetes version, you can use the existing guides until a guide for your version is added.
+
+### RKE2 Guides
+
+| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide |
+|------|--------------------|-----------------------|-----------------------|------------------|
+| Standalone RKE2 | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.rke2.io/security/cis_self_assessment18) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.rke2.io/security/cis_self_assessment19) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.rke2.io/security/cis_self_assessment110) | [Link](https://docs.rke2.io/security/hardening_guide) |
+| Standalone RKE2 | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.rke2.io/security/cis_self_assessment111) | [Link](https://docs.rke2.io/security/hardening_guide) |
+
+### K3s Guides
+
+| Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guide |
+|------|--------------------|-----------------------|-----------------------|------------------|
+| Standalone K3s | Kubernetes v1.26 | CIS v1.8 | [Link](https://docs.k3s.io/security/self-assessment-1.8) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.27 | CIS v1.9 | [Link](https://docs.k3s.io/security/self-assessment-1.9) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.28 | CIS v1.10 | [Link](https://docs.k3s.io/security/self-assessment-1.10) | [Link](https://docs.k3s.io/security/hardening-guide) |
+| Standalone K3s | Kubernetes v1.29 and above | CIS v1.11 | [Link](https://docs.k3s.io/security/self-assessment-1.11) | [Link](https://docs.k3s.io/security/hardening-guide) |
diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md
new file mode 100644
index 00000000000..e74ee2c20e0
--- /dev/null
+++ b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-k3s-selinux.md
@@ -0,0 +1,13 @@
+---
+title: About k3s-selinux
+---
+
+
+
+
+
+`k3s-selinux` provides policies for K3s. It is installed automatically when the K3s installer script detects that it is running on an RPM-based distro.
+
+The `k3s-selinux` GitHub repository is [here](https://github.com/rancher/k3s-selinux).
+
+For more information about installing K3s on SELinux-enabled hosts, see the [K3s documentation](https://docs.k3s.io/advanced#selinux-support).
\ No newline at end of file
diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
index 2a9adf1e4f2..b3be3dade1c 100644
--- a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
+++ b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md
@@ -16,7 +16,7 @@ The `rancher-selinux` GitHub repository is [here.](https://github.com/rancher/ra
:::note Requirement:
-The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
+The `rancher-selinux` RPM was tested on openSUSE Tumbleweed and RHEL-based distributions including Centos/RockyLinux 8 and 9.
:::
@@ -24,19 +24,6 @@ The rancher-selinux RPM was tested with CentOS 7, 8 and 9.
Set up the yum repo to install `rancher-selinux` directly on all hosts in the cluster.
-In order to use the RPM repository, on a CentOS 7 or RHEL 7 system, run the following bash snippet:
-
-```
-# cat << EOF > /etc/yum.repos.d/rancher.repo
-[rancher]
-name=Rancher
-baseurl=https://rpm.rancher.io/rancher/production/centos/7/noarch
-enabled=1
-gpgcheck=1
-gpgkey=https://rpm.rancher.io/public.key
-EOF
-```
-
In order to use the RPM repository, on a CentOS 8 or RHEL 8 system, run the following bash snippet:
```
@@ -71,14 +58,14 @@ Install the RPM:
yum -y install rancher-selinux
```
-## Configuring the Logging Application to Work with SELinux
+## Configuring the Logging and Monitoring Applications to Work with SELinux
:::note Requirement:
-Logging v2 was tested with SELinux on RHEL/CentOS 7, 8 and 9.
+Logging v2 and Monitoring v2 were tested with SELinux on RHEL/CentOS 8, 9, and Tumbleweed.
:::
Applications do not automatically work once the `rancher-selinux` RPM is installed on the host. They need to be configured to run in an allowed SELinux container domain provided by the RPM.
-To configure the `rancher-logging` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the chart.
+To configure the `rancher-logging` or the `rancher-monitoring` chart to be SELinux aware, change `global.seLinux.enabled` to true in the `values.yaml` when installing the charts.
diff --git a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
index 75df1de0d00..7d079c18300 100644
--- a/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
+++ b/versioned_docs/version-2.13/reference-guides/rancher-security/selinux-rpm/selinux-rpm.md
@@ -10,11 +10,14 @@ title: SELinux RPM
Developed by Red Hat, it is an implementation of mandatory access controls (MAC) on Linux. Mandatory access controls allow an administrator of a system to define how applications and users can access different resources such as files, devices, networks and inter-process communication. SELinux also enhances security by making an OS restrictive by default.
-After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8. To check whether SELinux is enabled and enforcing on your system, use `getenforce`:
+After being historically used by government agencies, SELinux is now an industry standard and enabled by default on SUSE distributions such as SUSE Linux Enterprise 16, openSUSE distributions such as openSUSE Tumbleweed, and RHEL-based OS such as Rocky Linux. To check whether SELinux is enabled and enforced on your system, use `getenforce`:
```
# getenforce
Enforcing
```
-We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: [`rancher-selinux`](about-rancher-selinux.md) and [`rke2-selinux`](about-rke2-selinux.md).
\ No newline at end of file
+We provide three RPMs (RPM Package Manager) that enable Rancher products to function properly on SELinux-enforcing hosts:
+- [`rancher-selinux`](about-rancher-selinux.md)
+- [`rke2-selinux`](about-rke2-selinux.md)
+- [`k3s-selinux`](about-k3s-selinux.md)
diff --git a/versioned_docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md b/versioned_docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
index 2ed1d943849..a26e9796c8b 100644
--- a/versioned_docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
+++ b/versioned_docs/version-2.9/how-to-guides/new-user-guides/manage-clusters/clean-cluster-nodes.md
@@ -200,7 +200,8 @@ You need to remove the following components from Rancher-provisioned RKE2 nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing RKE2
@@ -224,7 +225,8 @@ You need to remove the following components from Rancher-provisioned K3s nodes:
To remove the rancher-system-agent, run the [system-agent-uninstall.sh](https://github.com/rancher/system-agent/blob/main/system-agent-uninstall.sh) script:
```
-curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh | sudo sh
+curl https://raw.githubusercontent.com/rancher/system-agent/main/system-agent-uninstall.sh > system-agent-uninstall.sh
+sudo sh system-agent-uninstall.sh
```
### Removing K3s
diff --git a/versioned_sidebars/version-2.12-sidebars.json b/versioned_sidebars/version-2.12-sidebars.json
index e5954372223..ce1e737abd6 100644
--- a/versioned_sidebars/version-2.12-sidebars.json
+++ b/versioned_sidebars/version-2.12-sidebars.json
@@ -998,10 +998,10 @@
},
"items": [
"reference-guides/rancher-security/selinux-rpm/about-rancher-selinux",
- "reference-guides/rancher-security/selinux-rpm/about-rke2-selinux"
+ "reference-guides/rancher-security/selinux-rpm/about-rke2-selinux",
+ "reference-guides/rancher-security/selinux-rpm/about-k3s-selinux"
]
},
- "reference-guides/rancher-security/kubernetes-security-best-practices",
"reference-guides/rancher-security/rancher-security-best-practices",
"reference-guides/rancher-security/security-advisories-and-cves",
"reference-guides/rancher-security/psa-restricted-exemptions",
diff --git a/versioned_sidebars/version-2.13-sidebars.json b/versioned_sidebars/version-2.13-sidebars.json
index e5954372223..fec0adce00c 100644
--- a/versioned_sidebars/version-2.13-sidebars.json
+++ b/versioned_sidebars/version-2.13-sidebars.json
@@ -998,10 +998,11 @@
},
"items": [
"reference-guides/rancher-security/selinux-rpm/about-rancher-selinux",
- "reference-guides/rancher-security/selinux-rpm/about-rke2-selinux"
+ "reference-guides/rancher-security/selinux-rpm/about-rke2-selinux",
+ "reference-guides/rancher-security/selinux-rpm/about-k3s-selinux"
+
]
},
- "reference-guides/rancher-security/kubernetes-security-best-practices",
"reference-guides/rancher-security/rancher-security-best-practices",
"reference-guides/rancher-security/security-advisories-and-cves",
"reference-guides/rancher-security/psa-restricted-exemptions",