Skip to content

Commit 6249172

Browse files
addetzaddetz
committed
Merge branch 'master' into docs-rel-4-8-0
2 parents 9a87b98 + f158182 commit 6249172

File tree

4 files changed

+153
-67
lines changed

4 files changed

+153
-67
lines changed

‎_partials/packs/_ubuntu.mdx‎

Lines changed: 90 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,21 @@ partial_name: ubuntu
55

66
:::info
77

8-
<!-- prettier-ignore -->
9-
108
Review the <VersionedLink text="Maintenance Policy" url="/integrations/maintenance-policy/#os-packs" /> page to learn about our pack update and deprecation schedules.
119

12-
1310
:::
1411

1512
## Version Supported
1613

1714
<Tabs queryString="parent">
1815
<TabItem label="22.04 LTS" value="22.04.x">
1916

20-
<!-- prettier-ignore -->
17+
## Usage
2118

2219
To use the Ubuntu OS pack, add the pack to your cluster profile when you select the OS layer. Refer to the <VersionedLink text="Create an Infrastructure Profile" url="/profiles/cluster-profiles/create-cluster-profiles/create-infrastructure-profile" />
2320
guide to learn more.
2421

25-
26-
#### Add Custom Files
22+
### Add Custom Files
2723

2824
You can create custom files that you define in the `files` section that precedes the `preKubeadmCommands` and
2925
`postKubeadmCommands` sections. The files are invoked during runtime.
@@ -101,63 +97,100 @@ many other security hardening features. Ubuntu Pro offers several more benefits
10197
10298
For more information, refer to the [Ubuntu Pro](https://ubuntu.com/pro) documentation from Canonical.
10399
104-
You can enable Ubuntu Pro when deploying clusters with Palette. To enable Ubuntu Pro, select Ubuntu as the OS layer for
105-
a cluster profile and expand the **Preset Menu** to reveal the Ubuntu Pro parameters.
106-
107-
| Parameter | Description | Default Value |
108-
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
109-
| **token** | The Canonical subscription token for Ubuntu Pro. Refer to the Ubuntu Pro [subscribe page](https://ubuntu.com/pro/subscribe) to aquire a subscription token. | `""` |
110-
| **esm-apps** | Expanded Security Maintenance (ESM) for Applications. Refer to the Ubuntu [ESM documentation](https://ubuntu.com/security/esm) to learn more. | Disabled |
111-
| **livepatch** | Canonical Livepatch service. Refer to the Ubuntu [Livepatch](https://ubuntu.com/security/livepatch) documenation for more details. | Disabled |
112-
| **fips** | Federal Information Processing Standards (FIPS) 140 validated cryptography for Linux workloads on Ubuntu. This installs NIST-certified core packages. Refer to the Ubuntu [FIPS](https://ubuntu.com/security/certifications/docs/2204) documentation to learn more. | Disabled |
113-
| **fips-updates** | Install NIST-certified core packages with priority security updates. Refer to the Ubuntu [FIPS Updates](https://ubuntu.com/security/certifications/docs/fips-updates) documentation to learn more. | Disabled |
114-
| **cis** | Gain access to OpenSCAP-based tooling that automates both hardening and auditing with certified content based on published CIS benchmarks. Refer to the Ubuntu [CIS](https://ubuntu.com/security/certifications/docs/2204/usg/cis) documentation to learn more. | Disabled |
100+
#### Enable Ubuntu Pro
115101
116102
Use the following steps to enable Ubuntu Pro.
117103
118104
1. Log in to [Palette](https://console.spectrocloud.com).
119105
120-
2. Navigate to the left **Main Menu** and select **Profiles**.
106+
2. Navigate to the left main menu and select **Profiles**.
107+
108+
3. Click on **Add Cluster Profile**.
109+
110+
4. Fill out the basic information for the cluster profile. Ensure you select **Full** or **Infrastructure** for the profile **Type**. Click **Next** to continue.
111+
112+
5. Select the infrastructure provider and click **Next**.
113+
114+
6. Select Ubuntu as the OS layer and click **Next**.
115+
116+
7. On the **Configure Pack** page, in **Pack Details**, click on the **Values** option to reveal the YAML editor. Expand the **Presets** drawer.
117+
118+
8. Click the **Ubuntu Pro** checkbox to include the Ubuntu Pro parameters in the pack configuration file.
119+
120+
9. Provide the Canonical subscription token for Ubuntu Pro in the **Token** field. Refer to the Ubuntu Pro [subscribe page](https://ubuntu.com/pro/subscribe) to acquire a subscription token.
121+
122+
10. Toggle options on or off to enable or disable the various Ubuntu Pro services. The following table describes each of the available options.
123+
124+
| Parameter | Description |
125+
| ---------------- | ------------ |
126+
| **esm-infra** | Expanded Security Maintenance (ESM) for Infrastructure. Refer to the Ubuntu [ESM documentation](https://ubuntu.com/security/esm) to learn more. |
127+
| **esm-apps** | Expanded Security Maintenance (ESM) for Applications. Refer to the Ubuntu [ESM documentation](https://ubuntu.com/security/esm) to learn more. |
128+
| **fips** | Federal Information Processing Standards (FIPS) 140 validated cryptography for Linux workloads on Ubuntu. This installs NIST-certified core packages. Refer to the Ubuntu [FIPS](https://ubuntu.com/security/certifications/docs/2204) documentation to learn more. If you are using Ubuntu 22.04 on AWS IaaS clusters, refer to <VersionedLink text="Enable FIPS Mode on AWS Ubuntu 22.04" url="/integrations/packs/?pack=ubuntu-aws#enable-fips-mode-on-aws-ubuntu-2204" /> as additional YAML configuration is required. |
129+
| **fips-updates** | Install NIST-certified core packages with priority security updates. Refer to the Ubuntu [FIPS Updates](https://ubuntu.com/security/certifications/docs/fips-updates) documentation to learn more. If you are using Ubuntu 22.04 on AWS IaaS clusters, refer to <VersionedLink text="Enable FIPS Mode on AWS Ubuntu 22.04" url="/integrations/packs/?pack=ubuntu-aws#enable-fips-mode-on-aws-ubuntu-2204" /> as additional YAML configuration is required. |
130+
| **livepatch** | Canonical Livepatch service. Refer to the Ubuntu [Livepatch](https://ubuntu.com/security/livepatch) documentation for more details. |
131+
| **cis** | Gain access to OpenSCAP-based tooling that automates both hardening and auditing with certified content based on published CIS benchmarks. Refer to the Ubuntu [CIS](https://ubuntu.com/security/certifications/docs/2204/usg/cis) documentation to learn more. |
132+
| **cc-eal** | Common Criteria Evaluation Assurance Level (EAL) 2 certification for Ubuntu. Refer to the Ubuntu [Common Criteria](https://ubuntu.com/security/cc) documentation to learn more. |
133+
| **usg** | Ubuntu Security Guide (USG) for compliance hardening. Refer to the Ubuntu [USG](https://documentation.ubuntu.com/security/compliance/usg/) documentation to learn more. |
134+
135+
11. Click the **Next layer** button to continue to the next layer.
136+
137+
12. Complete the remainder of the cluster profile creation wizard by selecting the next cluster profile layers.
138+
139+
#### Enable FIPS Mode on AWS Ubuntu 22.04
140+
141+
1. Log in to [Palette](https://console.spectrocloud.com).
142+
143+
2. Navigate to the left main menu and select **Profiles**.
121144
122145
3. Click on **Add Cluster Profile**.
123146
124-
4. Fill out the input fields for **Name**, **Version**, **Description**, **Type** and **Tags**. Click on **Next** to
125-
continue.
147+
4. Fill out the basic information for the cluster profile. Ensure you select **Full** or **Infrastructure** for the profile **Type**. Click **Next** to continue.
126148
127-
5. Select the infrastructure provider and click on **Next**.
149+
5. Select the infrastructure provider and click **Next**.
128150
129-
6. Select the OS layer and use the following information to find the Ubuntu pack:
151+
6. Select **Ubuntu (AWS)** as the OS layer and click **Next**.
130152
131-
- **Pack Type** - OS
153+
7. On the **Configure Pack** page, in **Pack Details**, click on the **Values** option to reveal the YAML editor. Expand the **Presets** drawer.
132154
133-
- **Registry** - Public Repo
155+
8. Click the **Ubuntu Pro** checkbox to include the Ubuntu Pro parameters in the pack configuration file.
134156
135-
- **Pack Name** -Ubuntu
157+
9. Provide the Canonical subscription token for Ubuntu Pro in the **Token** field. Refer to the Ubuntu Pro [subscribe page](https://ubuntu.com/pro/subscribe) to acquire a subscription token.
136158
137-
- **Pack Version** - 20.04 or 22.04
159+
10. Enable the **fips** and **fips-updates** options.
138160
139-
7. Modify the Ubuntu **Pack values** to activate the **Presets** options for the Ubuntu YAML file. Click on the
140-
**\</\>** button to reveal the YAML editor and expand the **Preset Drawer**.
161+
11. In the YAML editor, under the `kubeadmconfig.postKubeadmCommands` section, add the `--assume-yes` flags to the `pro enable fips` and `pro enable fips-updates` commands. Additionally, add the `reboot` command at the end of the section.
141162

142-
![A view of the cluster profile creation wizard for Ubuntu Pro](/integrations_ubuntu_ubuntu-pro-preset-drawer.webp)
163+
The following example shows the required configuration.
143164

144-
8. Click the **Ubuntu Advantage/Pro** checkbox to include the Ubuntu Pro parameters in the pack configuration file.
165+
```yaml {4-6}
166+
kubeadmconfig:
167+
postKubeadmCommands:
168+
- pro attach <ubuntu-pro-token>
169+
- pro enable fips --assume-yes
170+
- pro enable fips-updates --assume-yes
171+
- reboot
172+
```
145173

146-
9. Toggle options on or off to enable or disable the various Ubuntu Pro services.
174+
When a cluster is deployed with these settings configured, Palette will automatically execute these commands on every node during bootstrap. These commands will perform the following actions.
147175

148-
10. Click the **Next layer** button to continue to the next layer.
176+
- Attaches the system to Canonical's Ubuntu Pro service.
177+
- Enables the FIPS-certified kernel and crypto modules.
178+
- Enables the FIPS updates for ongoing security updates on certified packages. This is recommended for production workloads.
179+
- Reboots the node to apply the FIPS-certified kernel and modules.
149180

150-
11. Complete the remainder of the cluster profile creation wizard by selecting the next cluster profile layers.
181+
12. Click the **Next layer** button to continue to the next layer.
182+
183+
13. Complete the remainder of the cluster profile creation wizard by selecting the next cluster profile layers.
151184

152185
</TabItem>
153186
<TabItem label="20.04 LTS" value="20.04.x">
154187

155-
<!-- prettier-ignore -->
188+
## Usage
156189

157190
To use the Ubuntu OS pack, add the pack to your cluster profile when you select the OS layer. Refer to the <VersionedLink text="Create an Infrastructure Profile" url="/profiles/cluster-profiles/create-cluster-profiles/create-infrastructure-profile" />
158191
guide to learn more.
159192

160-
#### Add Custom Files
193+
### Add Custom Files
161194

162195
You can create custom files that you define in the `files` section that precedes the `preKubeadmCommands` and
163196
`postKubeadmCommands` sections. The files are invoked during runtime.
@@ -235,59 +268,50 @@ many other security hardening features. Ubuntu Pro offers several more benefits
235268

236269
- Kernel Livepatch service to avoid reboots
237270

238-
- FIPS 140-3 Level 1 certified crypto modules
271+
- FIPS 140-2 Level 1 certified crypto modules
239272

240273
- Common Criteria EAL2
241274

242275
For more information, refer to the [Ubuntu Pro](https://ubuntu.com/pro) documentation from Canonical.
243276

244-
You can enable Ubuntu Pro when deploying clusters with Palette. To enable Ubuntu Pro, select Ubuntu as the OS for a
245-
cluster profile and expand the **Preset Menu** to reveal the Ubuntu Pro parameters.
246-
247-
| Parameter | Description | Default Value |
248-
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
249-
| **token** | The Canonical subscription token for Ubuntu Pro. Refer to the Ubuntu Pro [subscribe page](https://ubuntu.com/pro/subscribe) to aquire a subscription token. | `""` |
250-
| **esm-apps** | Expanded Security Maintenance (ESM) for Applications. Refer to the Ubuntu [ESM documentation](https://ubuntu.com/security/esm) to learn more. | Disabled |
251-
| **livepatch** | Canonical Livepatch service. Refer to the Ubuntu [Livepatch](https://ubuntu.com/security/livepatch) documenation for more details. | Disabled |
252-
| **fips** | Federal Information Processing Standards (FIPS) 140 validated cryptography for Linux workloads on Ubuntu. This installs NIST-certified core packages. Refer to the Ubuntu [FIPS](https://ubuntu.com/security/certifications/docs/2204) documentation to learn more. | Disabled |
253-
| **fips-updates** | Install NIST-certified core packages with priority security updates. Refer to the Ubuntu [FIPS Updates](https://ubuntu.com/security/certifications/docs/fips-updates) documentation to learn more. | Disabled |
254-
| **cis** | Gain access to OpenSCAP-based tooling that automates both hardening and auditing with certified content based on published CIS benchmarks. Refer to the Ubuntu [CIS](https://ubuntu.com/security/certifications/docs/2204/usg/cis) documentation to learn more. | Disabled |
277+
#### Enable Ubuntu Pro
255278

256279
Use the following steps to enable Ubuntu Pro.
257280

258281
1. Log in to [Palette](https://console.spectrocloud.com).
259282

260-
2. Navigate to the left **Main Menu** and select **Profiles**.
283+
2. Navigate to the left main menu and select **Profiles**.
261284

262285
3. Click on **Add Cluster Profile**.
263286

264-
4. Fill out the input fields for **Name**, **Version**, **Description**, **Type** and **Tags**. Click on **Next** to
265-
continue.
266-
267-
5. Select the infrastructure provider and click on **Next**.
268-
269-
6. Select the OS layer and use the following information to find the Ubuntu pack:
270-
271-
- **Pack Type** - OS
287+
4. Fill out the basic information for the cluster profile. Ensure you select **Full** or **Infrastructure** for the profile **Type**. Click **Next** to continue.
272288

273-
- **Registry** - Public Repo
289+
5. Select the infrastructure provider and click **Next**.
274290

275-
- **Pack Name** -Ubuntu
291+
6. Select Ubuntu as the OS layer and click **Next**.
276292

277-
- **Pack Version** - 20.04 or 22.04
293+
7. On the **Configure Pack** page, in **Pack Details**, click on the **Values** option to reveal the YAML editor. Expand the **Presets** drawer.
278294

279-
7. Modify the Ubuntu **Pack values** to activate the **Presets** options for the Ubuntu YAML file. Click on the
280-
**\</\>** button to reveal the YAML editor and expand the **Preset Drawer**.
295+
8. Click the **Ubuntu Pro** checkbox to include the Ubuntu Pro parameters in the pack configuration file.
281296

282-
![A view of the cluster profile creation wizard for Ubuntu Pro](/integrations_ubuntu_ubuntu-pro-preset-drawer.webp)
297+
9. Provide the Canonical subscription token for Ubuntu Pro in the **Token** field. Refer to the Ubuntu Pro [subscribe page](https://ubuntu.com/pro/subscribe) to acquire a subscription token.
283298

284-
8. Click the **Ubuntu Advantage/Pro** checkbox to include the Ubuntu Pro parameters in the pack configuration file.
299+
10. Toggle options on or off to enable or disable the various Ubuntu Pro services. The following table describes each of the available options.
285300

286-
9. Toggle options on or off to enable or disable the various Ubuntu Pro services.
301+
| Parameter | Description |
302+
| ---------------- | ------------ |
303+
| **esm-infra** | Expanded Security Maintenance (ESM) for Infrastructure. Refer to the Ubuntu [ESM documentation](https://ubuntu.com/security/esm) to learn more. |
304+
| **esm-apps** | Expanded Security Maintenance (ESM) for Applications. Refer to the Ubuntu [ESM documentation](https://ubuntu.com/security/esm) to learn more. |
305+
| **fips** | Federal Information Processing Standards (FIPS) 140 validated cryptography for Linux workloads on Ubuntu. This installs NIST-certified core packages. Refer to the Ubuntu [FIPS](https://ubuntu.com/security/certifications/docs/2204) documentation to learn more. |
306+
| **fips-updates** | Install NIST-certified core packages with priority security updates. Refer to the Ubuntu [FIPS Updates](https://ubuntu.com/security/certifications/docs/fips-updates) documentation to learn more. |
307+
| **livepatch** | Canonical Livepatch service. Refer to the Ubuntu [Livepatch](https://ubuntu.com/security/livepatch) documentation for more details. |
308+
| **cis** | Gain access to OpenSCAP-based tooling that automates both hardening and auditing with certified content based on published CIS benchmarks. Refer to the Ubuntu [CIS](https://ubuntu.com/security/certifications/docs/2204/usg/cis) documentation to learn more. |
309+
| **cc-eal** | Common Criteria Evaluation Assurance Level (EAL) 2 certification for Ubuntu. Refer to the Ubuntu [Common Criteria](https://ubuntu.com/security/cc) documentation to learn more. |
310+
| **usg** | Ubuntu Security Guide (USG) for compliance hardening. Refer to the Ubuntu [USG](https://documentation.ubuntu.com/security/compliance/usg/) documentation to learn more. |
287311

288-
10. Click the **Next layer** button to continue to the next layer.
312+
11. Click the **Next layer** button to continue to the next layer.
289313

290-
11. Complete the remainder of the cluster profile creation wizard by selecting the next cluster profile layers.
314+
12. Complete the remainder of the cluster profile creation wizard by selecting the next cluster profile layers.
291315

292316
</TabItem>
293317
</Tabs>

0 commit comments

Comments
 (0)