Add v2.6 hardening guides #3810

macedogm · 2022-01-21T14:57:30Z

Add hardening guides for Rancher v2.6.

We also need to upload, please, the following PDF files to our site:

File content/rancher/v2.6/en/security/hardening-guides/1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf to https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf
File content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf to https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf

Signed-off-by: Guilherme Macedo guilherme.macedo@suse.com

Added Nginx's validating webhook port

macedogm · 2022-01-21T19:49:16Z

I'm moving this temporarily to draft, while we wait for @anupama2501's review.

macedogm · 2022-02-02T09:24:39Z

As discussed with @cbron, PR is ready for review by Caleb and @paraglade.

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

paraglade

looks good enough to publish from what I can see

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

ryansann · 2022-02-18T21:18:45Z

@macedogm I have a few additional items in my cloud-config I use for hardening, posting here in case they are needed:

ssh_pwauth: false
runcmd:
...
# allow kubernetes api inbound traffic to 6443
- iptables -A INPUT -p tcp --dport 6443 -j ACCEPT
# allow etcd inbound traffic to 2379
- iptables -A INPUT -p tcp --dport 2379 -j ACCEPT

ryansann · 2022-02-18T21:31:51Z

Something about the PDF generation for the benchmark assessment is causing not enough padding to be added between lines in the Contents

(I tried this in multiple browsers and saw the same)

content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md

macedogm · 2022-02-21T10:47:19Z

@macedogm I have a few additional items in my cloud-config I use for hardening, posting here in case they are needed:
ssh_pwauth: false
runcmd:
...
# allow kubernetes api inbound traffic to 6443
- iptables -A INPUT -p tcp --dport 6443 -j ACCEPT
# allow etcd inbound traffic to 2379
- iptables -A INPUT -p tcp --dport 2379 -j ACCEPT

@ryansann Thanks for this idea. For now I added only ssh_pwauth: false, which is a great hardening step. I would refrain from adding the iptables rules now, to avoid messing with other possible firewall rules from the users.

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

macedogm · 2022-02-21T12:49:43Z

Something about the PDF generation for the benchmark assessment is causing not enough padding to be added between lines in the Contents

(I tried this in multiple browsers and saw the same)

@ryansann Thanks for spotting this. Somehow I missed, but it's fixed now. Can you please have a look if the new style for the contents section is better?

ryansann · 2022-02-22T17:29:12Z

Something about the PDF generation for the benchmark assessment is causing not enough padding to be added between lines in the Contents
(I tried this in multiple browsers and saw the same)

@ryansann Thanks for spotting this. Somehow I missed, but it's fixed now. Can you please have a look if the new style for the contents section is better?

No problem! I pulled the most recent changes and the PDFs look good now 👍

cbron · 2022-02-23T00:54:25Z

We either need to re-open this against staging, or do QA before we merge, as this PR will go live to docs site.

cbron

Didn't deep dive but seems fine to me besides branch changes. Will need to talk to docs team about PDFs.

cbron · 2022-02-23T01:49:41Z

content/rancher/v2.6/en/security/hardening-guides/_index.md

+| Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides |
+| --- | --- | --- | --- |
+| Kubernetes v1.18 | CIS v1.5 | [Link](https://docs.rke2.io/security/cis_self_assessment15/) | [Link](https://docs.rke2.io/security/hardening_guide/) |
+| Kubernetes v1.20 | CIS v1.6 | [Link](https://docs.rke2.io/security/cis_self_assessment16/) | [Link](https://docs.rke2.io/security/hardening_guide/) |


Are we also going to link our rke2 guides down the road ? We can adjust then, just curious.

Yes, in case you want to have them separated from the current RKE2 guides. My initial plan was only to update those guides in their current place (docs.rke2.io), instead of "forking" them to be inside rancher.com/docs. WDYT?

If there are details specific to Rancher then it should be on Rancher side. RKE2 docs should be standalone RKE2 only.

macedogm · 2022-02-23T10:28:56Z

We either need to re-open this against staging, or do QA before we merge, as this PR will go live to docs site.

@cbron okay, I changed the branch to go to staging.

@btat can you please advise how this now goes to staging and then master? Is this done automatically or do I need to keep track?

macedogm · 2022-02-23T10:32:34Z

Didn't deep dive but seems fine to me besides branch changes. Will need to talk to docs team about PDFs.

@btat regarding this point raised by Caleb, do you want to change the format/styling of the PDFs? I reused the same format and style of the current guides, but a revamp in terms of branding might be good too. Please let me know if you want to chat about this.

btat · 2022-02-24T02:04:06Z

We either need to re-open this against staging, or do QA before we merge, as this PR will go live to docs site.

@cbron okay, I changed the branch to go to staging.

@btat can you please advise how this now goes to staging and then master? Is this done automatically or do I need to keep track?

@macedogm after this is merged to staging, you do not need to keep track of it. The docs team will handle bringing over updates from staging back to master, which will happen around release time.

Didn't deep dive but seems fine to me besides branch changes. Will need to talk to docs team about PDFs.

@btat regarding this point raised by Caleb, do you want to change the format/styling of the PDFs? I reused the same format and style of the current guides, but a revamp in terms of branding might be good too. Please let me know if you want to chat about this.

The current format/styling looks fine to me, but I'm not familiar with the latest branding guidelines. I can circulate this among the docs team for additional feedback and then we can sync up afterwards if needed.

macedogm · 2022-02-24T14:07:12Z

@btat

@macedogm after this is merged to staging, you do not need to keep track of it. The docs team will handle bringing over updates from staging back to master, which will happen around release time.

Thanks!

The current format/styling looks fine to me, but I'm not familiar with the latest branding guidelines. I can circulate this among the docs team for additional feedback and then we can sync up afterwards if needed.

Also thanks for checking this. 👍🏻

macedogm · 2022-03-14T21:03:35Z

@btat I believe that this PR is also good to be merged to staging.

btat · 2022-03-14T21:05:25Z

@btat I believe that this PR is also good to be merged to staging.

Done :)

bentastic27 and others added 2 commits January 20, 2022 11:00

Added Nginx's validating webhook port

4863fa4

Merge pull request #3804 from rancher/nginx-webhook-port

9e373b8

Added Nginx's validating webhook port

macedogm requested a review from cbron January 21, 2022 14:59

macedogm mentioned this pull request Jan 21, 2022

Update the CIS Hardening Guide for 2.6x rancher/rancher#35735

Closed

macedogm requested a review from paraglade January 21, 2022 15:52

macedogm marked this pull request as draft January 21, 2022 19:48

macedogm requested a review from anupama2501 January 21, 2022 20:02

macedogm marked this pull request as ready for review February 2, 2022 09:23

macedogm mentioned this pull request Feb 4, 2022

Remove dependency on jq in example #3030

Open

samjustus requested a review from ryansann February 8, 2022 17:26

macedogm added the release notes label Feb 14, 2022

samjustus removed the request for review from anupama2501 February 15, 2022 17:03

Add v2.6 hardening guides

91245d5

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

paraglade approved these changes Feb 16, 2022

View reviewed changes

Reference new restricted-noroot PSP in hardening guides

4b82a7a

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

ryansann reviewed Feb 18, 2022

View reviewed changes

content/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/_index.md Show resolved Hide resolved

Add hardening step and improve CSS style

2c44540

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>

ryansann approved these changes Feb 22, 2022

View reviewed changes

cbron reviewed Feb 23, 2022

View reviewed changes

macedogm changed the base branch from master to staging February 23, 2022 10:26

macedogm requested a review from btat February 23, 2022 10:29

btat approved these changes Feb 24, 2022

View reviewed changes

cbron approved these changes Mar 3, 2022

View reviewed changes

macedogm added 2 commits March 11, 2022 14:05

Replace jq command with jsonpath tempalte in kubectl

ee11131

Add extra configurations for tls-cipher-suites

6f801b8

btat merged commit 5fc62be into rancher:staging Mar 14, 2022

macedogm mentioned this pull request Mar 15, 2022

Update hardening guide to add bind-address flag #3953

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add v2.6 hardening guides #3810

Add v2.6 hardening guides #3810

macedogm commented Jan 21, 2022 •

edited

Loading

macedogm commented Jan 21, 2022 •

edited

Loading

macedogm commented Feb 2, 2022

paraglade left a comment

ryansann commented Feb 18, 2022

ryansann commented Feb 18, 2022

macedogm commented Feb 21, 2022

macedogm commented Feb 21, 2022 •

edited

Loading

ryansann commented Feb 22, 2022

cbron commented Feb 23, 2022

cbron left a comment •

edited

Loading

cbron Feb 23, 2022

macedogm Feb 23, 2022

cbron Mar 3, 2022

macedogm commented Feb 23, 2022 •

edited

Loading

macedogm commented Feb 23, 2022

btat commented Feb 24, 2022

macedogm commented Feb 24, 2022

macedogm commented Mar 14, 2022

btat commented Mar 14, 2022

Add v2.6 hardening guides #3810

Add v2.6 hardening guides #3810

Conversation

macedogm commented Jan 21, 2022 • edited Loading

macedogm commented Jan 21, 2022 • edited Loading

macedogm commented Feb 2, 2022

paraglade left a comment

Choose a reason for hiding this comment

ryansann commented Feb 18, 2022

ryansann commented Feb 18, 2022

macedogm commented Feb 21, 2022

macedogm commented Feb 21, 2022 • edited Loading

ryansann commented Feb 22, 2022

cbron commented Feb 23, 2022

cbron left a comment • edited Loading

Choose a reason for hiding this comment

cbron Feb 23, 2022

Choose a reason for hiding this comment

macedogm Feb 23, 2022

Choose a reason for hiding this comment

cbron Mar 3, 2022

Choose a reason for hiding this comment

macedogm commented Feb 23, 2022 • edited Loading

macedogm commented Feb 23, 2022

btat commented Feb 24, 2022

macedogm commented Feb 24, 2022

macedogm commented Mar 14, 2022

btat commented Mar 14, 2022

macedogm commented Jan 21, 2022 •

edited

Loading

macedogm commented Jan 21, 2022 •

edited

Loading

macedogm commented Feb 21, 2022 •

edited

Loading

cbron left a comment •

edited

Loading

macedogm commented Feb 23, 2022 •

edited

Loading