docs(install): allow enabling SELinux/AppArmor/host firewall on traditional OS nodes

[chinameok]

Jira: https://jira.alauda.cn/browse/AIT-73853

Why

Node preprocessing required SELinux, AppArmor and the host firewall to be disabled
unconditionally on traditional operating systems. Customers with mandatory security
baselines (STIG) need these mechanisms enabled. Alauda OS already ships with SELinux and
firewalld enabled and maintains the port rules itself; on a traditional OS the platform
cannot do that, so the requirement is relaxed and the missing information is documented.

Disabled remains the default and the recommended configuration. What changes is that
keeping a mechanism enabled is now a documented customer choice instead of a violation.

All three mechanisms are treated the same way. AppArmor is not singled out: the DISA STIG
for Canonical Ubuntu 22.04 LTS requires it (V-260557), and Ubuntu enables it by default, so
demanding that it stay off was neither defensible nor enforceable.

What

A. Security mechanisms (node_preprocessing.mdx)

• Reworked the security-mechanism check and the cross-node firewall check.
• New appendix Hardened Node Security Configuration. Its primary path is not to
  re-enable a mechanism after the fact. init.sh supports per-step skipping — verified
  against installer/res/init.sh in the shipped package, where every disable_* function
  guards on _skip "${FUNCNAME[0]}" — so the appendix tells the reader to pass
  --skip-disable_selinux, --skip-disable_apparmor, --skip-disable_firewalld or
  --skip-disable_ufw and keep the node in the state it was installed with. That avoids a
  full SELinux relabel and the extra reboot entirely.
• Recovering a node that already ran the full init.sh is documented separately, and
  relabels under permissive before switching to enforcing. Booting straight into
  enforcing on a freshly relabelled file system can leave the node unbootable or refuse
  SSH logins if the relabel was incomplete. The recovery path also covers the apparmor=0
  kernel command-line argument that init.sh can add and that a service restart does not
  clear.

B. Communication matrix (communication_matrix.mdx, new)

• The port list previously existed only on the internal wiki, so customers who enabled a
  host firewall had no way to know which ports to allow.
• States its scope: core components and Aligned extensions. Ports required by Agnostic
  extensions are maintained by those extensions.
• States explicitly that it is not a complete firewall configuration, and lists what it
  does not cover — Pod and Service traffic, secondary or non-default container networks,
  load balancer forwarding, Self-built VIP keepalived VRRP, global disaster recovery, and
  global-to-workload traffic — each pointing at the page that owns that requirement.

C. Supported OS list synced with the internal release baseline

• Kylin pinned to V11 2503.
• New Operating System Support Scope Changes section: Kubernetes 1.35 removed cgroup v1,
  so Kylin V10/V10 SP3, Ubuntu 20.04, RHEL 7.x/8.x and CentOS 7.x left the support scope in
  4.4. The migration paths name the same-vendor successors already in the 4.4 support list —
  RHEL 9.6 and Ubuntu 22.04 LTS — instead of routing every customer to Kylin. Alauda OS is
  listed as the immutable-OS option and flagged as the more expensive one. The OS change must
  happen before the platform upgrade.
• Removed the note Flannel is not supported on Kylin Linux Advanced Server V11, which is
  redundant now that Flannel is not offered for new clusters on this line (AIT-73865).

D. In-place OS upgrade (in_place_os_upgrade.mdx)

• The checks asserted "must be disabled", which now contradicts the above. They require the
  state the cluster was installed with instead.
• Step 3 is now Record the current node baseline and tells the operator to run the same
  base-configuration block before the upgrade and keep its output. Every post-upgrade
  comparison depends on that record, and nothing produced it before.
• The base-configuration block distinguishes "the unit is not present on this system" from
  "the unit is present but turned off", dumps the firewall rules, uses ufw status (the ufw
  unit reports active (exited) regardless of the ruleset), and no longer calls
  systemctl status, which pages through less and stalls a pasted run.
• The troubleshooting row for kubelet security-policy errors gives the remediation inline
  (ausearch, then restorecon or a full relabel) instead of linking to a section whose
  preamble excludes the case.

E. llms.txt — refreshed the node_preprocessing.mdx entry and added the new page.

F. on-premises.mdx — removed the obsolete port 11781 from the load balancer
forwarding requirement and from the global-to-workload access requirement. Confirmed with
the component owner: 11781 was the old HTTPS monitoring port and is no longer used; only
11780 is required.

Reviewer notes

• Deliberate deviation from the internal source. The 4.4 communication matrix on the
  wiki does not list the Calico ports (179/tcp, 9091/tcp, 9324/tcp), while 4.1-4.3 do.
  This is judged to be a gap in the source: Calico still runs on clusters upgraded from
  earlier versions, and omitting the ports would break BGP on those clusters once a firewall
  is enabled. The rows were added and marked conditional, with no claim about availability
  for new clusters.
• Open questions for the matrix owner, deliberately not changed here. 17946 is listed
  as TCP only; upstream MetalLB memberlist uses TCP and UDP on the same port, but whether
  ACP's deployment enables memberlist has not been verified. 7473 (frr-metrics) is
  carried over unchanged, although the two sibling MetalLB ports are the upstream default
  plus 10000 (7472→17472, 7946→17946) and this one is not. 2049 (nfs) has no
  identified owning component.
• Validated with yarn install + yarn lint: 0 errors, 0 warnings.

[cloudflare-workers-and-pages]

Deploying alauda-container-platform with    Cloudflare Pages

Latest commit:	133194c
Status:	✅  Deploy successful!
Preview URL:	https://a3179a83.alauda-container-platform.pages.dev
Branch Preview URL:	https://docs-ait-73853-node-security-k1tj.alauda-container-platform.pages.dev

View logs