deploy: 32d05e9489

2026-09-25 12:38:05 +00:00 · 2024-05-01 17:33:57 +00:00
parent 146af67d15
commit c8cd1f3715
5142 changed files with 15507 additions and 15444 deletions
@@ -324,8 +324,8 @@ const metadata = {
    "editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.7/faq/security.md",
    "tags": [],
    "version": "2.7",
-    "lastUpdatedAt": 1712697029,
-    "formattedLastUpdatedAt": "Apr 9, 2024",
+    "lastUpdatedAt": 1714583423,
+    "formattedLastUpdatedAt": "May 1, 2024",
    "frontMatter": {
        "title": "Security FAQ"
    },
@@ -340,7 +340,23 @@ const metadata = {
    }
 };
 const assets = {};
-const toc = [];
+const toc = [
+    {
+        value: 'Is there a Hardening Guide?',
+        id: 'is-there-a-hardening-guide',
+        level: 3
+    },
+    {
+        value: 'Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?',
+        id: 'have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results',
+        level: 3
+    },
+    {
+        value: 'How does Rancher verify communication with downstream clusters, and what are some associated security concerns?',
+        id: 'how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns',
+        level: 3
+    }
+];
 const layoutProps = {
    toc
 };
@@ -355,17 +371,22 @@ function MDXContent(_param) {
    }), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
        rel: "canonical",
        href: "https://ranchermanager.docs.rancher.com/faq/security"
-    })), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
-        parentName: "p"
-    }, `Is there a Hardening Guide?`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is now located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+    })), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "is-there-a-hardening-guide"
+    }, `Is there a Hardening Guide?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
        parentName: "p",
        "href": "/v2.7/reference-guides/rancher-security/"
-    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("br", null), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
-        parentName: "p"
-    }, `What are the results of Rancher's Kubernetes cluster when it is CIS benchmarked?`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results"
+    }, `Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
        parentName: "p",
        "href": "/v2.7/reference-guides/rancher-security/"
-    }, `Security`), ` section.`));
+    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns"
+    }, `How does Rancher verify communication with downstream clusters, and what are some associated security concerns?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Communication between the Rancher server and downstream clusters is performed through agents. Rancher uses either a registered certificate authority (CA) bundle or the local trust store to verify communication between Rancher agents and the Rancher server. Using a CA bundle for verification is more strict, as only the certificates based on that bundle are trusted. If TLS verification for a explicit CA bundle fails, Rancher may fall back to using the local trust store for verifying future communication. Any CA within the local trust store can then be used to generate a valid certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `As described in `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+        parentName: "p",
+        "href": "https://www.suse.com/c/rancher-security-update/"
+    }, `Rancher Security Update CVE-2024-22030`), `, under a narrow set of circumstances, malicious actors can take over Rancher nodes by exploiting the behavior of Rancher CAs. For the attack to succeed, the malicious actor must generate a valid certificate from either a valid CA in the targeted Rancher server, or from a valid registered CA. The attacker also needs to either hijack or spoof the Rancher server-url as a preliminary step. Rancher is currently evaluating Rancher CA behavior to mitigate against this and any similar avenues of attack.`));
 }
 MDXContent.isMDXComponent = true;

@@ -324,8 +324,8 @@ const metadata = {
    "editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.8/faq/security.md",
    "tags": [],
    "version": "2.8",
-    "lastUpdatedAt": 1712697029,
-    "formattedLastUpdatedAt": "Apr 9, 2024",
+    "lastUpdatedAt": 1714583423,
+    "formattedLastUpdatedAt": "May 1, 2024",
    "frontMatter": {
        "title": "Security FAQ"
    },
@@ -340,7 +340,23 @@ const metadata = {
    }
 };
 const assets = {};
-const toc = [];
+const toc = [
+    {
+        value: 'Is there a Hardening Guide?',
+        id: 'is-there-a-hardening-guide',
+        level: 3
+    },
+    {
+        value: 'Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?',
+        id: 'have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results',
+        level: 3
+    },
+    {
+        value: 'How does Rancher verify communication with downstream clusters, and what are some associated security concerns?',
+        id: 'how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns',
+        level: 3
+    }
+];
 const layoutProps = {
    toc
 };
@@ -355,17 +371,22 @@ function MDXContent(_param) {
    }), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
        rel: "canonical",
        href: "https://ranchermanager.docs.rancher.com/faq/security"
-    })), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
-        parentName: "p"
-    }, `Is there a Hardening Guide?`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is now located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+    })), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "is-there-a-hardening-guide"
+    }, `Is there a Hardening Guide?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
        parentName: "p",
        "href": "/v2.8/reference-guides/rancher-security/"
-    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("br", null), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
-        parentName: "p"
-    }, `What are the results of Rancher's Kubernetes cluster when it is CIS benchmarked?`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results"
+    }, `Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
        parentName: "p",
        "href": "/v2.8/reference-guides/rancher-security/"
-    }, `Security`), ` section.`));
+    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns"
+    }, `How does Rancher verify communication with downstream clusters, and what are some associated security concerns?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Communication between the Rancher server and downstream clusters is performed through agents. Rancher uses either a registered certificate authority (CA) bundle or the local trust store to verify communication between Rancher agents and the Rancher server. Using a CA bundle for verification is more strict, as only the certificates based on that bundle are trusted. If TLS verification for a explicit CA bundle fails, Rancher may fall back to using the local trust store for verifying future communication. Any CA within the local trust store can then be used to generate a valid certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `As described in `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+        parentName: "p",
+        "href": "https://www.suse.com/c/rancher-security-update/"
+    }, `Rancher Security Update CVE-2024-22030`), `, under a narrow set of circumstances, malicious actors can take over Rancher nodes by exploiting the behavior of Rancher CAs. For the attack to succeed, the malicious actor must generate a valid certificate from either a valid CA in the targeted Rancher server, or from a valid registered CA. The attacker also needs to either hijack or spoof the Rancher server-url as a preliminary step. Rancher is currently evaluating Rancher CA behavior to mitigate against this and any similar avenues of attack.`));
 }
 MDXContent.isMDXComponent = true;

@@ -324,8 +324,8 @@ const metadata = {
    "editUrl": "https://github.com/rancher/rancher-docs/edit/main/docs/faq/security.md",
    "tags": [],
    "version": "current",
-    "lastUpdatedAt": 1712697029,
-    "formattedLastUpdatedAt": "Apr 9, 2024",
+    "lastUpdatedAt": 1714583423,
+    "formattedLastUpdatedAt": "May 1, 2024",
    "frontMatter": {
        "title": "Security FAQ"
    },
@@ -340,7 +340,23 @@ const metadata = {
    }
 };
 const assets = {};
-const toc = [];
+const toc = [
+    {
+        value: 'Is there a Hardening Guide?',
+        id: 'is-there-a-hardening-guide',
+        level: 3
+    },
+    {
+        value: 'Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?',
+        id: 'have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results',
+        level: 3
+    },
+    {
+        value: 'How does Rancher verify communication with downstream clusters, and what are some associated security concerns?',
+        id: 'how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns',
+        level: 3
+    }
+];
 const layoutProps = {
    toc
 };
@@ -355,17 +371,22 @@ function MDXContent(_param) {
    }), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
        rel: "canonical",
        href: "https://ranchermanager.docs.rancher.com/faq/security"
-    })), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
-        parentName: "p"
-    }, `Is there a Hardening Guide?`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is now located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+    })), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "is-there-a-hardening-guide"
+    }, `Is there a Hardening Guide?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
        parentName: "p",
        "href": "/reference-guides/rancher-security/"
-    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("br", null), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
-        parentName: "p"
-    }, `What are the results of Rancher's Kubernetes cluster when it is CIS benchmarked?`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results"
+    }, `Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
        parentName: "p",
        "href": "/reference-guides/rancher-security/"
-    }, `Security`), ` section.`));
+    }, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
+        "id": "how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns"
+    }, `How does Rancher verify communication with downstream clusters, and what are some associated security concerns?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Communication between the Rancher server and downstream clusters is performed through agents. Rancher uses either a registered certificate authority (CA) bundle or the local trust store to verify communication between Rancher agents and the Rancher server. Using a CA bundle for verification is more strict, as only the certificates based on that bundle are trusted. If TLS verification for a explicit CA bundle fails, Rancher may fall back to using the local trust store for verifying future communication. Any CA within the local trust store can then be used to generate a valid certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `As described in `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
+        parentName: "p",
+        "href": "https://www.suse.com/c/rancher-security-update/"
+    }, `Rancher Security Update CVE-2024-22030`), `, under a narrow set of circumstances, malicious actors can take over Rancher nodes by exploiting the behavior of Rancher CAs. For the attack to succeed, the malicious actor must generate a valid certificate from either a valid CA in the targeted Rancher server, or from a valid registered CA. The attacker also needs to either hijack or spoof the Rancher server-url as a preliminary step. Rancher is currently evaluating Rancher CA behavior to mitigate against this and any similar avenues of attack.`));
 }
 MDXContent.isMDXComponent = true;

--- a/Show More
+++ b/Show More