From 1f88a6c543d9d5903409186a3ba560b6e7e27842 Mon Sep 17 00:00:00 2001 From: Taylor Price Date: Wed, 10 Jul 2019 11:04:31 -0700 Subject: [PATCH] fix k8s version number note admission control docs note encryption-provider-config flag --- content/rancher/v2.x/en/security/benchmark-2.2/_index.md | 2 +- content/rancher/v2.x/en/security/hardening-2.2/_index.md | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md b/content/rancher/v2.x/en/security/benchmark-2.2/_index.md index 78b3d316902..98d1185c39e 100644 --- a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md +++ b/content/rancher/v2.x/en/security/benchmark-2.2/_index.md @@ -1230,7 +1230,7 @@ docker inspect etcd | jq -e '.[0].Args[] | match("--peer-auto-tls(?:(?!=false).* **Notes** -RKE does not currently implement a seperate CA for etcd certificates. +RKE does not currently implement a separate CA for etcd certificates. This could be remediated by managing an external etcd cluster. `--trusted-ca-file` is set and different from the `--client-ca-file` used by `kube-apiserver`. diff --git a/content/rancher/v2.x/en/security/hardening-2.2/_index.md b/content/rancher/v2.x/en/security/hardening-2.2/_index.md index f82242d9565..bd93d04044d 100644 --- a/content/rancher/v2.x/en/security/hardening-2.2/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.2/_index.md @@ -3,7 +3,7 @@ title: Hardening Guide - Rancher v2.2.x weight: 100 --- -### Hardening Guide for Rancher 2.2.x with Kubernetes 1.11 +### Hardening Guide for Rancher 2.2.x with Kubernetes 1.13 @TODO generate PDF of this document [Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.2.x/Rancher_Hardening_Guide.pdf) @@ -98,6 +98,8 @@ kernel.panic_on_oops=1 Create a Kubernetes encryption configuration file on each of the RKE nodes that will be provisioned with the `controlplane` role: +**NOTE:** The `--experimental-encryption-provider-config` flag in Kubernetes 1.13+ is actually `--encryption-provider-config` + **Rationale** This configuration file will ensure that the Rancher RKE cluster encrypts secrets at rest, which Kubernetes does not do by default. @@ -401,6 +403,11 @@ rke up --config cluster.yml Ensure the RKE configuration is set to deploy the `kube-api` service with the options required for controls. +**NOTE:** + +Enabling the `AlwaysPullImages` admission control plugin can cause degraded performance due to overhead of always pulling images. +Enabling the `DenyEscalatingExec` admission control plugin will prevent the 'Launch kubectl' functionality in the UI from working. + **Rationale** To pass the following controls for the kube-api server ensure RKE configuration passes the appropriate options.