From e41b0c69ed933b719768d31187c7247cc7cabe8c Mon Sep 17 00:00:00 2001
From: Brian Downs <brian.downs@gmail.com>
Date: Thu, 22 Apr 2021 16:20:11 -0700
Subject: [PATCH 1/2] Update K3s security documentation.

Update security page to indicate that CIS 1.5 and 1.6 are covered by
this section.

Add network policy to Hardening Guide that shows how to allow for DNS
traffic.

Signed-off-by: Brian Downs <brian.downs@gmail.com>
---
 content/k3s/latest/en/security/_index.md      |  4 +++-
 .../en/security/hardening_guide/_index.md     | 22 +++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/security/_index.md b/content/k3s/latest/en/security/_index.md
index 7468e909504..7d05e6f756f 100644
--- a/content/k3s/latest/en/security/_index.md
+++ b/content/k3s/latest/en/security/_index.md
@@ -3,7 +3,9 @@ title: "Security"
 weight: 90
 ---
 
-This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections.
+This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. 
+
+The documents below apply to both CIS 1.5 & 1.6.
 
 * [Hardening Guide](./hardening_guide/)
 * [CIS Benchmark Self-Assessment Guide](./self_assessment/)
diff --git a/content/k3s/latest/en/security/hardening_guide/_index.md b/content/k3s/latest/en/security/hardening_guide/_index.md
index aa140f48ee3..53964eb43dd 100644
--- a/content/k3s/latest/en/security/hardening_guide/_index.md
+++ b/content/k3s/latest/en/security/hardening_guide/_index.md
@@ -280,6 +280,28 @@ spec:
             name: kube-system
 ```
 
+With the applied restrictions, DNS will be blocked unless purposely allowed. Below is a network policy that will allow for traffic to exist for DNS.
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-network-dns-policy
+  namespace: <NAMESPACE>
+spec:
+  ingress:
+  - ports:
+    - port: 53
+      protocol: TCP
+    - port: 53
+      protocol: UDP
+  podSelector:
+    matchLabels:
+      k8s-app: kube-dns
+  policyTypes:
+  - Ingress
+```
+
 > **Note:** Operators must manage network policies as normal for additional namespaces that are created.
 
 ## Known Issues

From ccdf351623f1d1692c120f53fcfb178f5a50ba16 Mon Sep 17 00:00:00 2001
From: Brian Downs <brian.downs@gmail.com>
Date: Tue, 27 Apr 2021 11:54:25 -0700
Subject: [PATCH 2/2] update main sec doc to include the etcd requirement

Signed-off-by: Brian Downs <brian.downs@gmail.com>
---
 content/k3s/latest/en/security/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/security/_index.md b/content/k3s/latest/en/security/_index.md
index 7d05e6f756f..f8b4285fc49 100644
--- a/content/k3s/latest/en/security/_index.md
+++ b/content/k3s/latest/en/security/_index.md
@@ -3,7 +3,7 @@ title: "Security"
 weight: 90
 ---
 
-This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. 
+This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. These guides assume k3s is running with embedded etcd.
 
 The documents below apply to both CIS 1.5 & 1.6.