| Control | Policy | @@ -90,7 +90,7 @@ enforced/disallowed:
| Host Ports |
- HostPorts should be disallowed, or at minimum restricted to a whitelist. + HostPorts should be disallowed, or at minimum restricted to a known list. Restricted Fields: spec.containers[*].ports[*].hostPort spec.initContainers[*].ports[*].hostPort - Allowed Values: 0, undefined, (whitelisted) + Allowed Values: 0, undefined (or restricted to a known list) |
| AppArmor (optional) |
- On supported hosts, the `runtime/default` AppArmor profile is applied by default. The default policy should prevent overriding or disabling the policy, or restrict overrides to a whitelisted set of profiles. + On supported hosts, the 'runtime/default' AppArmor profile is applied by default. The default policy should prevent overriding or disabling the policy, or restrict overrides to an allowed set of profiles. Restricted Fields: metadata.annotations['container.apparmor.security.beta.kubernetes.io/*'] - Allowed Values: runtime/default, undefined + Allowed Values: 'runtime/default', undefined |
| /proc Mount Type | +
+ The default /proc masks are set up to reduce attack surface, and should be required. + Restricted Fields: + spec.containers[*].securityContext.procMount + spec.initContainers[*].securityContext.procMount + Allowed Values: undefined/nil, 'Default' + |
+
| Sysctls | +
+ Sysctls can disable security mechanisms or affect all containers on a host, and should be disallowed except for an allowed "safe" subset.
+ A sysctl is considered safe if it is namespaced in the container or the Pod, and it is isolated from other Pods or processes on the same Node. + Restricted Fields: + spec.securityContext.sysctls + Allowed Values: + kernel.shm_rmid_forced + net.ipv4.ip_local_port_range + net.ipv4.tcp_syncookies + net.ipv4.ping_group_range + undefined/empty + |
+
| Control | @@ -184,7 +209,7 @@ well as lower-trust users.The following listed controls should be enforced/disal|
| Privilege Escalation |
- Privilege escalation to root should not be allowed. + Privilege escalation to root should not be allowed. Restricted Fields: spec.containers[*].securityContext.privileged spec.initContainers[*].securityContext.privileged @@ -194,7 +219,7 @@ well as lower-trust users.The following listed controls should be enforced/disal |
| Running as Non-root |
- Containers must be required to run as non-root users. + Containers must be required to run as non-root users. Restricted Fields: spec.securityContext.runAsNonRoot spec.containers[*].securityContext.runAsNonRoot @@ -205,7 +230,7 @@ well as lower-trust users.The following listed controls should be enforced/disal |
| Non-root groups (optional) |
- Containers should be forbidden from running with a root primary or supplementary GID. + Containers should be forbidden from running with a root primary or supplementary GID. Restricted Fields: spec.securityContext.runAsGroup spec.securityContext.supplementalGroups[*] @@ -224,12 +249,12 @@ well as lower-trust users.The following listed controls should be enforced/disal |
| Seccomp |
- The runtime/default seccomp profile must be required, or allow additional whitelisted values. + The 'runtime/default' seccomp profile must be required, or allow specific additional profiles. Restricted Fields: metadata.annotations['seccomp.security.alpha.kubernetes.io/pod'] metadata.annotations['container.seccomp.security.alpha.kubernetes.io/*'] Allowed Values: - runtime/default + 'runtime/default' undefined (container annotation) |
The `kubeadm` tool helps you bootstrap a minimum viable Kubernetes cluster that conforms to best practices. In fact, you can use `kubeadm` to set up a cluster that will pass the [Kubernetes Conformance tests](https://kubernetes.io/blog/2017/10/software-conformance-certification).
`kubeadm` also supports other cluster
@@ -24,9 +24,10 @@ of cloud servers, a Raspberry Pi, and more. Whether you're deploying into the
cloud or on-premises, you can integrate `kubeadm` into provisioning systems such
as Ansible or Terraform.
-{{% /capture %}}
-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
To follow this guide, you need:
@@ -53,9 +54,9 @@ slightly as the tool evolves, but the overall implementation should be pretty st
Any commands under `kubeadm alpha` are, by definition, supported on an alpha level.
{{< /note >}}
-{{% /capture %}}
-{{% capture steps %}}
+
+
## Objectives
@@ -312,12 +313,11 @@ kubectl apply -f https://docs.projectcalico.org/v3.14/manifests/calico.yaml
{{% /tab %}}
{{% tab name="Cilium" %}}
-For Cilium to work correctly, you must pass `--pod-network-cidr=10.217.0.0/16` to `kubeadm init`.
To deploy Cilium you just need to run:
```shell
-kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.6/install/kubernetes/quick-install.yaml
+kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml
```
Once all Cilium Pods are marked as `READY`, you start using your cluster.
@@ -495,10 +495,10 @@ and `scp` using that other user instead.
The `admin.conf` file gives the user _superuser_ privileges over the cluster.
This file should be used sparingly. For normal users, it's recommended to
-generate an unique credential to which you whitelist privileges. You can do
+generate an unique credential to which you grant privileges. You can do
this with the `kubeadm alpha kubeconfig user --client-name 
**kubeadm** vous aide à démarrer un cluster Kubernetes minimum,
viable et conforme aux meilleures pratiques. Avec kubeadm, votre cluster
@@ -78,18 +78,19 @@ problème de sécurité est trouvé. Voici les dernières versions de Kubernetes
| v1.12.x | Septembre 2018 | Juin 2019 |
| v1.13.x | Décembre 2018 | Septembre 2019 |
-{{% /capture %}}
-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
- Une ou plusieurs machines exécutant un système d'exploitation compatible deb/rpm, par exemple Ubuntu ou CentOS
- 2 Go ou plus de RAM par machine. Si vous essayez moins cela laissera trop peu de place pour vos applications.
- 2 processeurs ou plus sur le master
- Connectivité réseau entre toutes les machines du cluster, qu'il soit public ou privé.
-{{% /capture %}}
-{{% capture steps %}}
+
+
## Objectifs
diff --git a/content/fr/docs/setup/independent/ha-topology.md b/content/fr/docs/setup/independent/ha-topology.md
index 1253183c50..cd0b6aec36 100644
--- a/content/fr/docs/setup/independent/ha-topology.md
+++ b/content/fr/docs/setup/independent/ha-topology.md
@@ -1,11 +1,11 @@
---
title: Options pour la topologie en haute disponibilité
description: Topologie haute-disponibilité Kubernetes
-content_template: templates/concept
+content_type: concept
weight: 50
---
-{{% capture overview %}}
+
Cette page explique les deux options de configuration de topologie de vos clusters Kubernetes
pour la haute disponibilité.
@@ -17,9 +17,9 @@ Vous pouvez configurer un cluster en haute disponibilité:
Vous devez examiner attentivement les avantages et les inconvénients de chaque topologie avant
de configurer un cluster en haute disponibilité.
-{{% /capture %}}
-{{% capture body %}}
+
+
## Topologie etcd empilée
@@ -73,10 +73,10 @@ Un minimum de trois machines pour les nœuds du control plane et de trois machin
Schéma de la [Topologie externe etcd](/images/kubeadm/kubeadm-ha-topology-external-etcd.svg)
-{{% /capture %}}
-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
- [Configurer un cluster hautement disponible avec kubeadm](/docs/setup/independent/high-availability/)
-{{% /capture %}}
\ No newline at end of file
diff --git a/content/fr/docs/setup/independent/high-availability.md b/content/fr/docs/setup/independent/high-availability.md
index d8a95b5c89..210ba7e30c 100644
--- a/content/fr/docs/setup/independent/high-availability.md
+++ b/content/fr/docs/setup/independent/high-availability.md
@@ -1,11 +1,11 @@
---
title: Création de clusters hautement disponibles avec kubeadm
description: Cluster Kubernetes haute-disponibilité kubeadm
-content_template: templates/task
+content_type: task
weight: 60
---
-{{% capture overview %}}
+
Cette page explique deux approches différentes pour configurer un Kubernetes à haute disponibilité.
cluster utilisant kubeadm:
@@ -35,9 +35,10 @@ environnement Cloud, les approches documentées ici ne fonctionne ni avec des ob
load balancer, ni avec des volumes persistants dynamiques.
{{< /caution >}}
-{{% /capture %}}
-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
Pour les deux méthodes, vous avez besoin de cette infrastructure:
@@ -57,9 +58,9 @@ Les exemples suivants utilisent Calico en tant que fournisseur de réseau de Pod
CNI, pensez à remplacer les valeurs par défaut si nécessaire.
{{< /note >}}
-{{% /capture %}}
-{{% capture steps %}}
+
+
## Premières étapes pour les deux méthodes
@@ -344,4 +345,4 @@ Chaque nœud worker peut maintenant être joint au cluster avec la commande renv
de n’importe quelle commande `kubeadm init`. L'option `--experimental-control-plane` ne doit pas
être ajouté aux nœuds workers.
-{{% /capture %}}
+
diff --git a/content/fr/docs/setup/independent/install-kubeadm.md b/content/fr/docs/setup/independent/install-kubeadm.md
index 6366c6fdce..a32225872f 100644
--- a/content/fr/docs/setup/independent/install-kubeadm.md
+++ b/content/fr/docs/setup/independent/install-kubeadm.md
@@ -1,20 +1,21 @@
---
title: Installer kubeadm
description: kubeadm installation Kubernetes
-content_template: templates/task
+content_type: task
weight: 20
---
-{{% capture overview %}}
+