mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 04:58:07 +00:00
396 lines
15 KiB
JavaScript
396 lines
15 KiB
JavaScript
"use strict";
|
|
(self["webpackChunkrancher_docs"] = self["webpackChunkrancher_docs"] || []).push([[23840],{
|
|
|
|
/***/ 3905:
|
|
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
|
|
|
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
|
/* harmony export */ Zo: () => (/* binding */ MDXProvider),
|
|
/* harmony export */ kt: () => (/* binding */ createElement)
|
|
/* harmony export */ });
|
|
/* unused harmony exports MDXContext, useMDXComponents, withMDXComponents */
|
|
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
|
|
|
|
|
function _defineProperty(obj, key, value) {
|
|
if (key in obj) {
|
|
Object.defineProperty(obj, key, {
|
|
value: value,
|
|
enumerable: true,
|
|
configurable: true,
|
|
writable: true
|
|
});
|
|
} else {
|
|
obj[key] = value;
|
|
}
|
|
|
|
return obj;
|
|
}
|
|
|
|
function _extends() {
|
|
_extends = Object.assign || function (target) {
|
|
for (var i = 1; i < arguments.length; i++) {
|
|
var source = arguments[i];
|
|
|
|
for (var key in source) {
|
|
if (Object.prototype.hasOwnProperty.call(source, key)) {
|
|
target[key] = source[key];
|
|
}
|
|
}
|
|
}
|
|
|
|
return target;
|
|
};
|
|
|
|
return _extends.apply(this, arguments);
|
|
}
|
|
|
|
function ownKeys(object, enumerableOnly) {
|
|
var keys = Object.keys(object);
|
|
|
|
if (Object.getOwnPropertySymbols) {
|
|
var symbols = Object.getOwnPropertySymbols(object);
|
|
if (enumerableOnly) symbols = symbols.filter(function (sym) {
|
|
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
|
});
|
|
keys.push.apply(keys, symbols);
|
|
}
|
|
|
|
return keys;
|
|
}
|
|
|
|
function _objectSpread2(target) {
|
|
for (var i = 1; i < arguments.length; i++) {
|
|
var source = arguments[i] != null ? arguments[i] : {};
|
|
|
|
if (i % 2) {
|
|
ownKeys(Object(source), true).forEach(function (key) {
|
|
_defineProperty(target, key, source[key]);
|
|
});
|
|
} else if (Object.getOwnPropertyDescriptors) {
|
|
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
|
} else {
|
|
ownKeys(Object(source)).forEach(function (key) {
|
|
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
|
});
|
|
}
|
|
}
|
|
|
|
return target;
|
|
}
|
|
|
|
function _objectWithoutPropertiesLoose(source, excluded) {
|
|
if (source == null) return {};
|
|
var target = {};
|
|
var sourceKeys = Object.keys(source);
|
|
var key, i;
|
|
|
|
for (i = 0; i < sourceKeys.length; i++) {
|
|
key = sourceKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
target[key] = source[key];
|
|
}
|
|
|
|
return target;
|
|
}
|
|
|
|
function _objectWithoutProperties(source, excluded) {
|
|
if (source == null) return {};
|
|
|
|
var target = _objectWithoutPropertiesLoose(source, excluded);
|
|
|
|
var key, i;
|
|
|
|
if (Object.getOwnPropertySymbols) {
|
|
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
|
|
|
for (i = 0; i < sourceSymbolKeys.length; i++) {
|
|
key = sourceSymbolKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
|
target[key] = source[key];
|
|
}
|
|
}
|
|
|
|
return target;
|
|
}
|
|
|
|
var isFunction = function isFunction(obj) {
|
|
return typeof obj === 'function';
|
|
};
|
|
|
|
var MDXContext = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createContext({});
|
|
var withMDXComponents = function withMDXComponents(Component) {
|
|
return function (props) {
|
|
var allComponents = useMDXComponents(props.components);
|
|
return /*#__PURE__*/React.createElement(Component, _extends({}, props, {
|
|
components: allComponents
|
|
}));
|
|
};
|
|
};
|
|
var useMDXComponents = function useMDXComponents(components) {
|
|
var contextComponents = react__WEBPACK_IMPORTED_MODULE_0__.useContext(MDXContext);
|
|
var allComponents = contextComponents;
|
|
|
|
if (components) {
|
|
allComponents = isFunction(components) ? components(contextComponents) : _objectSpread2(_objectSpread2({}, contextComponents), components);
|
|
}
|
|
|
|
return allComponents;
|
|
};
|
|
var MDXProvider = function MDXProvider(props) {
|
|
var allComponents = useMDXComponents(props.components);
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(MDXContext.Provider, {
|
|
value: allComponents
|
|
}, props.children);
|
|
};
|
|
|
|
var TYPE_PROP_NAME = 'mdxType';
|
|
var DEFAULTS = {
|
|
inlineCode: 'code',
|
|
wrapper: function wrapper(_ref) {
|
|
var children = _ref.children;
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(react__WEBPACK_IMPORTED_MODULE_0__.Fragment, {}, children);
|
|
}
|
|
};
|
|
var MDXCreateElement = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.forwardRef(function (props, ref) {
|
|
var propComponents = props.components,
|
|
mdxType = props.mdxType,
|
|
originalType = props.originalType,
|
|
parentName = props.parentName,
|
|
etc = _objectWithoutProperties(props, ["components", "mdxType", "originalType", "parentName"]);
|
|
|
|
var components = useMDXComponents(propComponents);
|
|
var type = mdxType;
|
|
var Component = components["".concat(parentName, ".").concat(type)] || components[type] || DEFAULTS[type] || originalType;
|
|
|
|
if (propComponents) {
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2(_objectSpread2({
|
|
ref: ref
|
|
}, etc), {}, {
|
|
components: propComponents
|
|
}));
|
|
}
|
|
|
|
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2({
|
|
ref: ref
|
|
}, etc));
|
|
});
|
|
MDXCreateElement.displayName = 'MDXCreateElement';
|
|
function createElement (type, props) {
|
|
var args = arguments;
|
|
var mdxType = props && props.mdxType;
|
|
|
|
if (typeof type === 'string' || mdxType) {
|
|
var argsLength = args.length;
|
|
var createElementArgArray = new Array(argsLength);
|
|
createElementArgArray[0] = MDXCreateElement;
|
|
var newProps = {};
|
|
|
|
for (var key in props) {
|
|
if (hasOwnProperty.call(props, key)) {
|
|
newProps[key] = props[key];
|
|
}
|
|
}
|
|
|
|
newProps.originalType = type;
|
|
newProps[TYPE_PROP_NAME] = typeof type === 'string' ? type : mdxType;
|
|
createElementArgArray[1] = newProps;
|
|
|
|
for (var i = 2; i < argsLength; i++) {
|
|
createElementArgArray[i] = args[i];
|
|
}
|
|
|
|
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, createElementArgArray);
|
|
}
|
|
|
|
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, args);
|
|
}
|
|
|
|
|
|
|
|
|
|
/***/ }),
|
|
|
|
/***/ 10506:
|
|
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
|
|
|
__webpack_require__.r(__webpack_exports__);
|
|
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
|
/* harmony export */ assets: () => (/* binding */ assets),
|
|
/* harmony export */ contentTitle: () => (/* binding */ contentTitle),
|
|
/* harmony export */ "default": () => (/* binding */ MDXContent),
|
|
/* harmony export */ frontMatter: () => (/* binding */ frontMatter),
|
|
/* harmony export */ metadata: () => (/* binding */ metadata),
|
|
/* harmony export */ toc: () => (/* binding */ toc)
|
|
/* harmony export */ });
|
|
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
|
/* harmony import */ var _mdx_js_react__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3905);
|
|
/* @jsxRuntime classic */ /* @jsx mdx */ /* @jsxFrag React.Fragment */ function _define_property(obj, key, value) {
|
|
if (key in obj) {
|
|
Object.defineProperty(obj, key, {
|
|
value: value,
|
|
enumerable: true,
|
|
configurable: true,
|
|
writable: true
|
|
});
|
|
} else {
|
|
obj[key] = value;
|
|
}
|
|
return obj;
|
|
}
|
|
function _object_spread(target) {
|
|
for(var i = 1; i < arguments.length; i++){
|
|
var source = arguments[i] != null ? arguments[i] : {};
|
|
var ownKeys = Object.keys(source);
|
|
if (typeof Object.getOwnPropertySymbols === "function") {
|
|
ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
|
|
return Object.getOwnPropertyDescriptor(source, sym).enumerable;
|
|
}));
|
|
}
|
|
ownKeys.forEach(function(key) {
|
|
_define_property(target, key, source[key]);
|
|
});
|
|
}
|
|
return target;
|
|
}
|
|
function ownKeys(object, enumerableOnly) {
|
|
var keys = Object.keys(object);
|
|
if (Object.getOwnPropertySymbols) {
|
|
var symbols = Object.getOwnPropertySymbols(object);
|
|
if (enumerableOnly) {
|
|
symbols = symbols.filter(function(sym) {
|
|
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
|
});
|
|
}
|
|
keys.push.apply(keys, symbols);
|
|
}
|
|
return keys;
|
|
}
|
|
function _object_spread_props(target, source) {
|
|
source = source != null ? source : {};
|
|
if (Object.getOwnPropertyDescriptors) {
|
|
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
|
} else {
|
|
ownKeys(Object(source)).forEach(function(key) {
|
|
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
|
});
|
|
}
|
|
return target;
|
|
}
|
|
function _object_without_properties(source, excluded) {
|
|
if (source == null) return {};
|
|
var target = _object_without_properties_loose(source, excluded);
|
|
var key, i;
|
|
if (Object.getOwnPropertySymbols) {
|
|
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
|
for(i = 0; i < sourceSymbolKeys.length; i++){
|
|
key = sourceSymbolKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
|
target[key] = source[key];
|
|
}
|
|
}
|
|
return target;
|
|
}
|
|
function _object_without_properties_loose(source, excluded) {
|
|
if (source == null) return {};
|
|
var target = {};
|
|
var sourceKeys = Object.keys(source);
|
|
var key, i;
|
|
for(i = 0; i < sourceKeys.length; i++){
|
|
key = sourceKeys[i];
|
|
if (excluded.indexOf(key) >= 0) continue;
|
|
target[key] = source[key];
|
|
}
|
|
return target;
|
|
}
|
|
|
|
|
|
const frontMatter = {
|
|
title: 'Security FAQ'
|
|
};
|
|
const contentTitle = undefined;
|
|
const metadata = {
|
|
"unversionedId": "faq/security",
|
|
"id": "faq/security",
|
|
"title": "Security FAQ",
|
|
"description": "Is there a Hardening Guide?",
|
|
"source": "@site/docs/faq/security.md",
|
|
"sourceDirName": "faq",
|
|
"slug": "/faq/security",
|
|
"permalink": "/faq/security",
|
|
"draft": false,
|
|
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/docs/faq/security.md",
|
|
"tags": [],
|
|
"version": "current",
|
|
"lastUpdatedAt": 1714583423,
|
|
"formattedLastUpdatedAt": "May 1, 2024",
|
|
"frontMatter": {
|
|
"title": "Security FAQ"
|
|
},
|
|
"sidebar": "tutorialSidebar",
|
|
"previous": {
|
|
"title": "Technical FAQ",
|
|
"permalink": "/faq/technical-items"
|
|
},
|
|
"next": {
|
|
"title": "Telemetry FAQ",
|
|
"permalink": "/faq/telemetry"
|
|
}
|
|
};
|
|
const assets = {};
|
|
const toc = [
|
|
{
|
|
value: 'Is there a Hardening Guide?',
|
|
id: 'is-there-a-hardening-guide',
|
|
level: 3
|
|
},
|
|
{
|
|
value: 'Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?',
|
|
id: 'have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results',
|
|
level: 3
|
|
},
|
|
{
|
|
value: 'How does Rancher verify communication with downstream clusters, and what are some associated security concerns?',
|
|
id: 'how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns',
|
|
level: 3
|
|
}
|
|
];
|
|
const layoutProps = {
|
|
toc
|
|
};
|
|
const MDXLayout = "wrapper";
|
|
function MDXContent(_param) {
|
|
var { components } = _param, props = _object_without_properties(_param, [
|
|
"components"
|
|
]);
|
|
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(MDXLayout, _object_spread_props(_object_spread({}, layoutProps, props), {
|
|
components: components,
|
|
mdxType: "MDXLayout"
|
|
}), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
|
|
rel: "canonical",
|
|
href: "https://ranchermanager.docs.rancher.com/faq/security"
|
|
})), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
|
"id": "is-there-a-hardening-guide"
|
|
}, `Is there a Hardening Guide?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The Hardening Guide is located in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
|
parentName: "p",
|
|
"href": "/reference-guides/rancher-security/"
|
|
}, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
|
"id": "have-hardened-rancher-kubernetes-clusters-been-evaluated-by-the-cis-kubernetes-benchmark-where-can-i-find-the-results"
|
|
}, `Have hardened Rancher Kubernetes clusters been evaluated by the CIS Kubernetes Benchmark? Where can I find the results?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster. The results of that assessment can be found in the main `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
|
parentName: "p",
|
|
"href": "/reference-guides/rancher-security/"
|
|
}, `Security`), ` section.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
|
|
"id": "how-does-rancher-verify-communication-with-downstream-clusters-and-what-are-some-associated-security-concerns"
|
|
}, `How does Rancher verify communication with downstream clusters, and what are some associated security concerns?`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Communication between the Rancher server and downstream clusters is performed through agents. Rancher uses either a registered certificate authority (CA) bundle or the local trust store to verify communication between Rancher agents and the Rancher server. Using a CA bundle for verification is more strict, as only the certificates based on that bundle are trusted. If TLS verification for a explicit CA bundle fails, Rancher may fall back to using the local trust store for verifying future communication. Any CA within the local trust store can then be used to generate a valid certificate.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `As described in `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
|
|
parentName: "p",
|
|
"href": "https://www.suse.com/c/rancher-security-update/"
|
|
}, `Rancher Security Update CVE-2024-22030`), `, under a narrow set of circumstances, malicious actors can take over Rancher nodes by exploiting the behavior of Rancher CAs. For the attack to succeed, the malicious actor must generate a valid certificate from either a valid CA in the targeted Rancher server, or from a valid registered CA. The attacker also needs to either hijack or spoof the Rancher server-url as a preliminary step. Rancher is currently evaluating Rancher CA behavior to mitigate against this and any similar avenues of attack.`));
|
|
}
|
|
MDXContent.isMDXComponent = true;
|
|
|
|
|
|
/***/ })
|
|
|
|
}]); |