Skip to content

Commit 5f66a48

Browse files
committed
Hide old cis and remove 1.20 information
Signed-off-by: manuelbuil <mbuil@suse.com>
1 parent 69e2589 commit 5f66a48

File tree

2 files changed

+1
-59
lines changed

2 files changed

+1
-59
lines changed

docs/security/hardening-guide.md

Lines changed: 1 addition & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -405,11 +405,7 @@ spec:
405405
- Ingress
406406
```
407407

408-
The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2. Ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster.
409-
410-
<Tabs>
411-
<TabItem value="v1.21 and Newer" default>
412-
408+
The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Ensure that you use the sample yaml below:
413409
```yaml
414410
apiVersion: networking.k8s.io/v1
415411
kind: NetworkPolicy
@@ -452,60 +448,7 @@ spec:
452448
- {}
453449
policyTypes:
454450
- Ingress
455-
---
456-
457451
```
458-
</TabItem>
459-
460-
<TabItem value="v1.20 and Older" default>
461-
462-
```yaml
463-
apiVersion: networking.k8s.io/v1
464-
kind: NetworkPolicy
465-
metadata:
466-
name: allow-all-metrics-server
467-
namespace: kube-system
468-
spec:
469-
podSelector:
470-
matchLabels:
471-
k8s-app: metrics-server
472-
ingress:
473-
- {}
474-
policyTypes:
475-
- Ingress
476-
---
477-
apiVersion: networking.k8s.io/v1
478-
kind: NetworkPolicy
479-
metadata:
480-
name: allow-all-svclbtraefik-ingress
481-
namespace: kube-system
482-
spec:
483-
podSelector:
484-
matchLabels:
485-
svccontroller.k3s.cattle.io/svcname: traefik
486-
ingress:
487-
- {}
488-
policyTypes:
489-
- Ingress
490-
---
491-
apiVersion: networking.k8s.io/v1
492-
kind: NetworkPolicy
493-
metadata:
494-
name: allow-all-traefik-v120-ingress
495-
namespace: kube-system
496-
spec:
497-
podSelector:
498-
matchLabels:
499-
app: traefik
500-
ingress:
501-
- {}
502-
policyTypes:
503-
- Ingress
504-
---
505-
506-
```
507-
</TabItem>
508-
</Tabs>
509452

510453
:::info
511454
Operators must manage network policies as normal for additional namespaces that are created.

sidebars.js

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ module.exports = {
4747
'security/hardening-guide',
4848
'security/self-assessment-1.8',
4949
'security/self-assessment-1.7',
50-
'security/self-assessment-1.24',
5150
],
5251
},
5352
{

0 commit comments

Comments
 (0)