mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-27 21:50:21 +00:00
379 lines
14 KiB
JavaScript
379 lines
14 KiB
JavaScript
"use strict";
|
|
(self["webpackChunkrancher_docs"] = self["webpackChunkrancher_docs"] || []).push([[67331],{
|
|
|
|
/***/ 3905:
|
|
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
|
|
|
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
|
/* harmony export */ Zo: () => (/* binding */ MDXProvider),
|
|
/* harmony export */ kt: () => (/* binding */ createElement)
|
|
/* harmony export */ });
|
|
/* unused harmony exports MDXContext, useMDXComponents, withMDXComponents */
|
|
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
|
|
|
|
|
function _defineProperty(obj, key, value) {
|
|
if (key in obj) {
|
|
Object.defineProperty(obj, key, {
|
|
value: value,
|
|
enumerable: true,
|
|
configurable: true,
|
|
writable: true
|
|
});
|
|
} else {
|
|
obj[key] = value;
|
|
}
|
|
|
|
return obj;
|
|
}
|
|
|
|
function _extends() {
|
|
_extends = Object.assign || function (target) {
|
|
for (var i = 1; i < arguments.length; i++) {
|
|
var source = arguments[i];
|
|
|
|
for (var key in source) {
|
|
if (Object.prototype.hasOwnProperty.call(source, key)) {
|
|
target[key] = source[key];
|
|
}
|
|
}
|
|
}
|
|
|
|
return target;
|
|
};
|
|
|
|
return _extends.apply(this, arguments);
|
|
}
|
|
|
|
function ownKeys(object, enumerableOnly) {
|
|
var keys = Object.keys(object);
|
|
|
|
if (Object.getOwnPropertySymbols) {
|
|
var symbols = Object.getOwnPropertySymbols(object);
|
|
if (enumerableOnly) symbols = symbols.filter(function (sym) {
|
|
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
|
});
|
|
keys.push.apply(keys, symbols);
|
|
}
|
|
|
|
return keys;
|
|
}
|
|
|
|
function _objectSpread2(target) {
|
|
for (var i = 1; i < arguments.length; i++) {
|
|
var source = arguments[i] != null ? arguments[i] : {};
|
|
|
|
if (i % 2) {
|
|
ownKeys(Object(source), true).forEach(function (key) {
|
|
_defineProperty(target, key, source[key]);
|
|
});
|
|
} else if (Object.getOwnPropertyDescriptors) {
|
|
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
|
} else {
|
|
ownKeys(Object(source)).forEach(function (key) {
|
|
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
|
});
|
|
}
|
|
}
|
|
|
|
return target;
|
|
}
|
|
|
|
function _objectWithoutPropertiesLoose(source, excluded) {
|
|
if (source == null) return {};
|
|
var target = {};
|
|
var sourceKeys = Object.keys(source);
|
|
var key, i;
|
|
|
|
for (i = 0; i < sourceKeys.length; i++) {
|
|
key = sourceKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
target[key] = source[key];
|
|
}
|
|
|
|
return target;
|
|
}
|
|
|
|
function _objectWithoutProperties(source, excluded) {
|
|
if (source == null) return {};
|
|
|
|
var target = _objectWithoutPropertiesLoose(source, excluded);
|
|
|
|
var key, i;
|
|
|
|
if (Object.getOwnPropertySymbols) {
|
|
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
|
|
|
for (i = 0; i < sourceSymbolKeys.length; i++) {
|
|
key = sourceSymbolKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
|
target[key] = source[key];
|
|
}
|
|
}
|
|
|
|
return target;
|
|
}
|
|
|
|
var isFunction = function isFunction(obj) {
|
|
return typeof obj === 'function';
|
|
};
|
|
|
|
var MDXContext = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createContext({});
|
|
var withMDXComponents = function withMDXComponents(Component) {
|
|
return function (props) {
|
|
var allComponents = useMDXComponents(props.components);
|
|
return /*#__PURE__*/React.createElement(Component, _extends({}, props, {
|
|
components: allComponents
|
|
}));
|
|
};
|
|
};
|
|
var useMDXComponents = function useMDXComponents(components) {
|
|
var contextComponents = react__WEBPACK_IMPORTED_MODULE_0__.useContext(MDXContext);
|
|
var allComponents = contextComponents;
|
|
|
|
if (components) {
|
|
allComponents = isFunction(components) ? components(contextComponents) : _objectSpread2(_objectSpread2({}, contextComponents), components);
|
|
}
|
|
|
|
return allComponents;
|
|
};
|
|
var MDXProvider = function MDXProvider(props) {
|
|
var allComponents = useMDXComponents(props.components);
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(MDXContext.Provider, {
|
|
value: allComponents
|
|
}, props.children);
|
|
};
|
|
|
|
var TYPE_PROP_NAME = 'mdxType';
|
|
var DEFAULTS = {
|
|
inlineCode: 'code',
|
|
wrapper: function wrapper(_ref) {
|
|
var children = _ref.children;
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(react__WEBPACK_IMPORTED_MODULE_0__.Fragment, {}, children);
|
|
}
|
|
};
|
|
var MDXCreateElement = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.forwardRef(function (props, ref) {
|
|
var propComponents = props.components,
|
|
mdxType = props.mdxType,
|
|
originalType = props.originalType,
|
|
parentName = props.parentName,
|
|
etc = _objectWithoutProperties(props, ["components", "mdxType", "originalType", "parentName"]);
|
|
|
|
var components = useMDXComponents(propComponents);
|
|
var type = mdxType;
|
|
var Component = components["".concat(parentName, ".").concat(type)] || components[type] || DEFAULTS[type] || originalType;
|
|
|
|
if (propComponents) {
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2(_objectSpread2({
|
|
ref: ref
|
|
}, etc), {}, {
|
|
components: propComponents
|
|
}));
|
|
}
|
|
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2({
|
|
ref: ref
|
|
}, etc));
|
|
});
|
|
MDXCreateElement.displayName = 'MDXCreateElement';
|
|
function createElement (type, props) {
|
|
var args = arguments;
|
|
var mdxType = props && props.mdxType;
|
|
|
|
if (typeof type === 'string' || mdxType) {
|
|
var argsLength = args.length;
|
|
var createElementArgArray = new Array(argsLength);
|
|
createElementArgArray[0] = MDXCreateElement;
|
|
var newProps = {};
|
|
|
|
for (var key in props) {
|
|
if (hasOwnProperty.call(props, key)) {
|
|
newProps[key] = props[key];
|
|
}
|
|
}
|
|
|
|
newProps.originalType = type;
|
|
newProps[TYPE_PROP_NAME] = typeof type === 'string' ? type : mdxType;
|
|
createElementArgArray[1] = newProps;
|
|
|
|
for (var i = 2; i < argsLength; i++) {
|
|
createElementArgArray[i] = args[i];
|
|
}
|
|
|
|
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, createElementArgArray);
|
|
}
|
|
|
|
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, args);
|
|
}
|
|
|
|
|
|
|
|
|
|
/***/ }),
|
|
|
|
/***/ 87690:
|
|
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
|
|
|
__webpack_require__.r(__webpack_exports__);
|
|
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
|
/* harmony export */ assets: () => (/* binding */ assets),
|
|
/* harmony export */ contentTitle: () => (/* binding */ contentTitle),
|
|
/* harmony export */ "default": () => (/* binding */ MDXContent),
|
|
/* harmony export */ frontMatter: () => (/* binding */ frontMatter),
|
|
/* harmony export */ metadata: () => (/* binding */ metadata),
|
|
/* harmony export */ toc: () => (/* binding */ toc)
|
|
/* harmony export */ });
|
|
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
|
/* harmony import */ var _mdx_js_react__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3905);
|
|
/* @jsxRuntime classic */ /* @jsx mdx */ /* @jsxFrag React.Fragment */ function _define_property(obj, key, value) {
|
|
if (key in obj) {
|
|
Object.defineProperty(obj, key, {
|
|
value: value,
|
|
enumerable: true,
|
|
configurable: true,
|
|
writable: true
|
|
});
|
|
} else {
|
|
obj[key] = value;
|
|
}
|
|
return obj;
|
|
}
|
|
function _object_spread(target) {
|
|
for(var i = 1; i < arguments.length; i++){
|
|
var source = arguments[i] != null ? arguments[i] : {};
|
|
var ownKeys = Object.keys(source);
|
|
if (typeof Object.getOwnPropertySymbols === "function") {
|
|
ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
|
|
return Object.getOwnPropertyDescriptor(source, sym).enumerable;
|
|
}));
|
|
}
|
|
ownKeys.forEach(function(key) {
|
|
_define_property(target, key, source[key]);
|
|
});
|
|
}
|
|
return target;
|
|
}
|
|
function ownKeys(object, enumerableOnly) {
|
|
var keys = Object.keys(object);
|
|
if (Object.getOwnPropertySymbols) {
|
|
var symbols = Object.getOwnPropertySymbols(object);
|
|
if (enumerableOnly) {
|
|
symbols = symbols.filter(function(sym) {
|
|
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
|
});
|
|
}
|
|
keys.push.apply(keys, symbols);
|
|
}
|
|
return keys;
|
|
}
|
|
function _object_spread_props(target, source) {
|
|
source = source != null ? source : {};
|
|
if (Object.getOwnPropertyDescriptors) {
|
|
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
|
} else {
|
|
ownKeys(Object(source)).forEach(function(key) {
|
|
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
|
});
|
|
}
|
|
return target;
|
|
}
|
|
function _object_without_properties(source, excluded) {
|
|
if (source == null) return {};
|
|
var target = _object_without_properties_loose(source, excluded);
|
|
var key, i;
|
|
if (Object.getOwnPropertySymbols) {
|
|
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
|
for(i = 0; i < sourceSymbolKeys.length; i++){
|
|
key = sourceSymbolKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
|
target[key] = source[key];
|
|
}
|
|
}
|
|
return target;
|
|
}
|
|
function _object_without_properties_loose(source, excluded) {
|
|
if (source == null) return {};
|
|
var target = {};
|
|
var sourceKeys = Object.keys(source);
|
|
var key, i;
|
|
for(i = 0; i < sourceKeys.length; i++){
|
|
key = sourceKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
target[key] = source[key];
|
|
}
|
|
return target;
|
|
}
|
|
|
|
|
|
const frontMatter = {
|
|
title: 'Kubernetes Security Best Practices'
|
|
};
|
|
const contentTitle = undefined;
|
|
const metadata = {
|
|
"unversionedId": "reference-guides/rancher-security/kubernetes-security-best-practices",
|
|
"id": "version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices",
|
|
"title": "Kubernetes Security Best Practices",
|
|
"description": "Restricting cloud metadata API access",
|
|
"source": "@site/versioned_docs/version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices.md",
|
|
"sourceDirName": "reference-guides/rancher-security",
|
|
"slug": "/reference-guides/rancher-security/kubernetes-security-best-practices",
|
|
"permalink": "/v2.6/reference-guides/rancher-security/kubernetes-security-best-practices",
|
|
"draft": false,
|
|
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices.md",
|
|
"tags": [],
|
|
"version": "2.6",
|
|
"lastUpdatedAt": 1696258051,
|
|
"formattedLastUpdatedAt": "Oct 2, 2023",
|
|
"frontMatter": {
|
|
"title": "Kubernetes Security Best Practices"
|
|
},
|
|
"sidebar": "tutorialSidebar",
|
|
"previous": {
|
|
"title": "About rke2-selinux",
|
|
"permalink": "/v2.6/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux"
|
|
},
|
|
"next": {
|
|
"title": "Security Advisories and CVEs",
|
|
"permalink": "/v2.6/reference-guides/rancher-security/security-advisories-and-cves"
|
|
}
|
|
};
|
|
const assets = {};
|
|
const toc = [
|
|
{
|
|
value: 'Restricting cloud metadata API access',
|
|
id: 'restricting-cloud-metadata-api-access',
|
|
level: 3
|
|
}
|
|
];
|
|
const layoutProps = {
|
|
toc
|
|
};
|
|
const MDXLayout = "wrapper";
|
|
function MDXContent(_param) {
|
|
var { components } = _param, props = _object_without_properties(_param, [
|
|
"components"
|
|
]);
|
|
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(MDXLayout, _object_spread_props(_object_spread({}, layoutProps, props), {
|
|
components: components,
|
|
mdxType: "MDXLayout"
|
|
}), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
|
|
rel: "canonical",
|
|
href: "https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/kubernetes-security-best-practices"
|
|
})), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
|
"id": "restricting-cloud-metadata-api-access"
|
|
}, `Restricting cloud metadata API access`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
|
parentName: "p",
|
|
"href": "https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access"
|
|
}, `Kubernetes security recommendations`), `: limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `It is advised to consult your cloud provider's security best practices for further recommendations and specific details on how to restrict access to cloud instance metadata API.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Further references: MITRE ATT&CK knowledge base on - `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
|
parentName: "p",
|
|
"href": "https://attack.mitre.org/techniques/T1552/005/"
|
|
}, `Unsecured Credentials: Cloud Instance Metadata API`), `.`));
|
|
}
|
|
MDXContent.isMDXComponent = true;
|
|
|
|
|
|
/***/ })
|
|
|
|
}]); |