public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
gh-pages
rancher-docs/reference-guides/rancher-security.html
T

30 lines
36 KiB
HTML
Raw Permalink Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-reference-guides/rancher-security/rancher-security" data-has-hydrated="false">
<head>
<meta charset="UTF-8">
<meta name="generator" content="Docusaurus v2.4.3">
<title data-rh="true">Rancher Security Guides | Rancher</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Rancher Security Guides | Rancher"><meta data-rh="true" name="description" content="Security policy"><meta data-rh="true" property="og:description" content="Security policy"><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security" hreflang="en"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/zh/reference-guides/rancher-security" hreflang="zh"><link data-rh="true" rel="alternate" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link data-rh="true" rel="canonical" href="https://ranchermanager.docs.rancher.com/reference-guides/rancher-security"><link rel="preconnect" href="https://www.googletagmanager.com">
<script>window.dataLayer=window.dataLayer||[]</script>
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
<link rel="search" type="application/opensearchdescription+xml" title="Rancher" href="/opensearch.xml">
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.dea80607.css">
<link rel="preload" href="/assets/js/runtime~main.d98f8a34.js" as="script">
<link rel="preload" href="/assets/js/main.e9ebdfba.js" as="script">
</head>
<body class="navigation-with-keyboard">
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}return t}()||function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">Latest</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/reference-guides/rancher-security">Latest</a></li><li><a class="dropdown__link" href="/v2.9/reference-guides/rancher-security">v2.9 (Preview)</a></li><li><a class="dropdown__link" href="/v2.8/reference-guides/rancher-security">v2.8</a></li><li><a class="dropdown__link" href="/v2.7/reference-guides/rancher-security">v2.7</a></li><li><a class="dropdown__link" href="/v2.6/reference-guides/rancher-security">v2.6</a></li><li><a class="dropdown__link" href="/v2.5/reference-guides/rancher-security">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4/reference-guides/rancher-security">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div><div class="navbar__item dropdown dropdown--hoverable"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/reference-guides/rancher-security" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/reference-guides/rancher-security" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">Quick Links</a><ul class="dropdown__menu"><li><a href="https://github.com/rancher/rancher" target="_blank" rel="noopener noreferrer" class="dropdown__link">GitHub<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="dropdown__link">Docs GitHub<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link">More from SUSE</a><ul class="dropdown__menu"><li><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__rancher">Rancher<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><hr style="margin: 0.3rem 0;"></li><li><a href="https://elemental.docs.rancher.com/" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__elemental">Elemental<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://fleet.rancher.io/" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__fleet">Fleet<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://harvesterhci.io" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__harvester">Harvester<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><a href="https://rancherdesktop.io/" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__rancher__desktop">Rancher Desktop<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li><hr style="margin: 0.3rem 0;"></li><li><a href="https://opensource.suse.com" target="_blank" rel="noopener noreferrer" class="dropdown__link navbar__icon navbar__suse">More Projects...<svg width="12" height="12" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/">What is Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/getting-started/overview">Getting Started</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/how-to-guides/new-user-guides">How-to Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/reference-guides/best-practices">Reference Guides</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/best-practices">Best Practice Guides</a><button aria-label="Toggle the collapsible sidebar category &#x27;Best Practice Guides&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/rancher-manager-architecture">Rancher Architecture</a><button aria-label="Toggle the collapsible sidebar category &#x27;Rancher Architecture&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/cluster-configuration">Cluster Configuration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Cluster Configuration&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/single-node-rancher-in-docker">Single-Node Rancher in Docker</a><button aria-label="Toggle the collapsible sidebar category &#x27;Single-Node Rancher in Docker&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/backup-restore-configuration">Backup &amp; Restore Configuration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Backup &amp; Restore Configuration&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/kubernetes-concepts">Kubernetes Concepts</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/monitoring-v2-configuration">Monitoring Configuration Reference</a><button aria-label="Toggle the collapsible sidebar category &#x27;Monitoring Configuration Reference&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/prometheus-federator">Prometheus Federator</a><button aria-label="Toggle the collapsible sidebar category &#x27;Prometheus Federator&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/user-settings">User Settings</a><button aria-label="Toggle the collapsible sidebar category &#x27;User Settings&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/cli-with-rancher">CLI with Rancher</a><button aria-label="Toggle the collapsible sidebar category &#x27;CLI with Rancher&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-cluster-tools">Cluster Tools for Logging, Monitoring, and Visibility</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-project-tools">Project Tools for Logging, Monitoring, and Visibility</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/system-tools">System Tools</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rke1-template-example-yaml">RKE1 Example YAML</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-webhook">Rancher Webhook</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible menu__list-item-collapsible--active"><a class="menu__link menu__link--sublist menu__link--active" aria-current="page" aria-expanded="true" tabindex="0" href="/reference-guides/rancher-security">Rancher Security Guides</a><button aria-label="Toggle the collapsible sidebar category &#x27;Rancher Security Guides&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/rancher-security/hardening-guides">Hardening Guides</a><button aria-label="Toggle the collapsible sidebar category &#x27;Hardening Guides&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/reference-guides/rancher-security/selinux-rpm">SELinux RPM</a><button aria-label="Toggle the collapsible sidebar category &#x27;SELinux RPM&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-security/kubernetes-security-best-practices">Kubernetes Security Best Practices</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-security/rancher-security-best-practices">Rancher Security Best Practices</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-security/security-advisories-and-cves">Security Advisories and CVEs</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-security/psa-restricted-exemptions">Sample PodSecurityConfiguration</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-security/rancher-webhook-hardening">Hardening the Rancher Webhook</a></li></ul></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" href="/integrations-in-rancher">Integrations in Rancher</a><button aria-label="Toggle the collapsible sidebar category &#x27;Integrations in Rancher&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/faq/general-faq">FAQ</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/troubleshooting/general-troubleshooting">Troubleshooting</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/api/quickstart">Rancher Kubernetes API</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/contribute-to-rancher">Contributing to Rancher</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/glossary">Glossary</a></li></ul></nav></div></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_YNFT"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Reference Guides</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Rancher Security Guides</span><meta itemprop="position" content="2"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: Latest</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Rancher Security Guides</h1></header><table width="100%"><tr style="vertical-align:top"><td width="30%" style="border:none"><h4>Security policy</h4><p style="padding:8px">Rancher Labs supports responsible disclosure, and endeavours to resolve all issues in a reasonable time frame. </p></td><td width="30%" style="border:none"><h4>Reporting process</h4><p style="padding:8px">Please submit possible security issues by emailing <a href="mailto:security-rancher@suse.com" target="_blank" rel="noopener noreferrer">security-rancher@suse.com</a> .</p></td><td width="30%" style="border:none"><h4>Announcements</h4><p style="padding:8px">Subscribe to the <a href="https://forums.rancher.com/c/announcements" target="_blank" rel="noopener noreferrer">Rancher announcements forum</a> for release updates.</p></td></tr></table><p>Security is at the heart of all Rancher features. From integrating with all the popular authentication tools and services, to an enterprise grade <a href="/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac">RBAC capability</a>, Rancher makes your Kubernetes clusters even more secure.</p><p>On this page, we provide security related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="neuvector-integration-with-rancher">NeuVector Integration with Rancher<a href="#neuvector-integration-with-rancher" class="hash-link" aria-label="Direct link to NeuVector Integration with Rancher" title="Direct link to NeuVector Integration with Rancher">​</a></h3><p>NeuVector is an open-source, container-focused security application that is now integrated into Rancher. NeuVector provides production security, DevOps vulnerability protection, and a container firewall, et al. Please see the <a href="/integrations-in-rancher/neuvector">Rancher docs</a> and the <a href="https://open-docs.neuvector.com/" target="_blank" rel="noopener noreferrer">NeuVector docs</a> for more information.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="running-a-cis-security-scan-on-a-kubernetes-cluster">Running a CIS Security Scan on a Kubernetes Cluster<a href="#running-a-cis-security-scan-on-a-kubernetes-cluster" class="hash-link" aria-label="Direct link to Running a CIS Security Scan on a Kubernetes Cluster" title="Direct link to Running a CIS Security Scan on a Kubernetes Cluster">​</a></h3><p>Rancher leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank" rel="noopener noreferrer">kube-bench</a> to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the <a href="https://www.cisecurity.org/cis-benchmarks/" target="_blank" rel="noopener noreferrer">CIS</a> (Center for Internet Security) Kubernetes Benchmark.</p><p>The CIS Kubernetes Benchmark is a reference document that can be used to establish a secure configuration baseline for Kubernetes.</p><p>The Center for Internet Security (CIS) is a 501(c<!-- -->)<!-- -->(3) non-profit organization, formed in October 2000, with a mission to &quot;identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace&quot;.</p><p>CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.</p><p>The Benchmark provides recommendations of two types: Automated and Manual. We run tests related to only Automated recommendations.</p><p>When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests.</p><p>For details, refer to the section on <a href="/how-to-guides/advanced-user-guides/cis-scan-guides">security scans</a>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="selinux-rpm">SELinux RPM<a href="#selinux-rpm" class="hash-link" aria-label="Direct link to SELinux RPM" title="Direct link to SELinux RPM">​</a></h3><p><a href="https://en.wikipedia.org/wiki/Security-Enhanced_Linux" target="_blank" rel="noopener noreferrer">Security-Enhanced Linux (SELinux)</a> is a security enhancement to Linux. After being historically used by government agencies, SELinux is now industry standard and is enabled by default on CentOS 7 and 8.</p><p>We provide two RPMs (Red Hat packages) that enable Rancher products to function properly on SELinux-enforcing hosts: <code>rancher-selinux</code> and <code>rke2-selinux</code>. For details, see <a href="/reference-guides/rancher-security/selinux-rpm">this page</a>.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="rancher-hardening-guide">Rancher Hardening Guide<a href="#rancher-hardening-guide" class="hash-link" aria-label="Direct link to Rancher Hardening Guide" title="Direct link to Rancher Hardening Guide">​</a></h3><p>The Rancher Hardening Guide is based on controls and best practices found in the <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank" rel="noopener noreferrer">CIS Kubernetes Benchmark</a> from the Center for Internet Security.</p><p>The hardening guides provide prescriptive guidance for hardening a production installation of Rancher. See Rancher&#x27;s guides for <a href="#the-cis-benchmark-and-self-assessment">Self Assessment of the CIS Kubernetes Benchmark</a> for the full list of security controls.</p><blockquote><p>The hardening guides describe how to secure the nodes in your cluster, and it is recommended to follow a hardening guide before installing Kubernetes.</p></blockquote><p>Each version of the hardening guide is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="the-cis-benchmark-and-self-assessment">The CIS Benchmark and Self-Assessment<a href="#the-cis-benchmark-and-self-assessment" class="hash-link" aria-label="Direct link to The CIS Benchmark and Self-Assessment" title="Direct link to The CIS Benchmark and Self-Assessment">​</a></h3><p>The benchmark self-assessment is a companion to the Rancher security hardening guide. While the hardening guide shows you how to harden the cluster, the benchmark guide is meant to help you evaluate the level of security of the hardened cluster.</p><p>Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don&#x27;t apply. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. The original benchmark documents can be downloaded from the <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank" rel="noopener noreferrer">CIS website</a>.</p><p>Each version of Rancher&#x27;s self-assessment guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="third-party-penetration-test-reports">Third-party Penetration Test Reports<a href="#third-party-penetration-test-reports" class="hash-link" aria-label="Direct link to Third-party Penetration Test Reports" title="Direct link to Third-party Penetration Test Reports">​</a></h3><p>Rancher periodically hires third parties to perform security audits and penetration tests of the Rancher software stack. The environments under test follow the Rancher provided hardening guides at the time of the testing. Previous penetration test reports are available below.</p><p>Results:</p><ul><li><a href="https://releases.rancher.com/documents/security/pen-tests/2019/RAN-01-cure53-report.final.pdf" target="_blank" rel="noopener noreferrer">Cure53 Pen Test - July 2019</a></li><li><a href="https://releases.rancher.com/documents/security/pen-tests/2019/UntamedTheory-Rancher_SecurityAssessment-20190712_v5.pdf" target="_blank" rel="noopener noreferrer">Untamed Theory Pen Test - March 2019</a></li></ul><p>Please note that new reports are no longer shared or made publicly available.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="rancher-security-advisories-and-cves">Rancher Security Advisories and CVEs<a href="#rancher-security-advisories-and-cves" class="hash-link" aria-label="Direct link to Rancher Security Advisories and CVEs" title="Direct link to Rancher Security Advisories and CVEs">​</a></h3><p>Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to <a href="/reference-guides/rancher-security/security-advisories-and-cves">this page.</a></p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="kubernetes-security-best-practices">Kubernetes Security Best Practices<a href="#kubernetes-security-best-practices" class="hash-link" aria-label="Direct link to Kubernetes Security Best Practices" title="Direct link to Kubernetes Security Best Practices">​</a></h3><p>For recommendations on securing your Kubernetes cluster, refer to the <a href="/reference-guides/rancher-security/kubernetes-security-best-practices">Kubernetes Security Best Practices</a> guide.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="rancher-security-best-practices">Rancher Security Best Practices<a href="#rancher-security-best-practices" class="hash-link" aria-label="Direct link to Rancher Security Best Practices" title="Direct link to Rancher Security Best Practices">​</a></h3><p>For recommendations on securing your Rancher Manager deployments, refer to the <a href="/reference-guides/rancher-security/rancher-security-best-practices">Rancher Security Best Practices</a> guide.</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/reference-guides/rancher-security/rancher-security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2024-04-09T21:10:29.000Z">Apr 9, 2024</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href="/reference-guides/rancher-webhook"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Rancher Webhook</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/reference-guides/rancher-security/hardening-guides"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Self-Assessment and Hardening Guides for Rancher</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#neuvector-integration-with-rancher" class="table-of-contents__link toc-highlight">NeuVector Integration with Rancher</a></li><li><a href="#running-a-cis-security-scan-on-a-kubernetes-cluster" class="table-of-contents__link toc-highlight">Running a CIS Security Scan on a Kubernetes Cluster</a></li><li><a href="#selinux-rpm" class="table-of-contents__link toc-highlight">SELinux RPM</a></li><li><a href="#rancher-hardening-guide" class="table-of-contents__link toc-highlight">Rancher Hardening Guide</a></li><li><a href="#the-cis-benchmark-and-self-assessment" class="table-of-contents__link toc-highlight">The CIS Benchmark and Self-Assessment</a></li><li><a href="#third-party-penetration-test-reports" class="table-of-contents__link toc-highlight">Third-party Penetration Test Reports</a></li><li><a href="#rancher-security-advisories-and-cves" class="table-of-contents__link toc-highlight">Rancher Security Advisories and CVEs</a></li><li><a href="#kubernetes-security-best-practices" class="table-of-contents__link toc-highlight">Kubernetes Security Best Practices</a></li><li><a href="#rancher-security-best-practices" class="table-of-contents__link toc-highlight">Rancher Security Best Practices</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2024 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/assets/js/runtime~main.d98f8a34.js"></script>
<script src="/assets/js/main.e9ebdfba.js"></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink