docs(install): allow enabling SELinux/AppArmor/host firewall on traditional OS nodes

[chinameok]

Jira: https://jira.alauda.cn/browse/AIT-73853

Why

Node preprocessing required SELinux, AppArmor and the host firewall to be disabled
unconditionally on traditional operating systems. Customers with mandatory security
baselines (STIG) need these mechanisms enabled. Alauda OS already ships with SELinux and
firewalld enabled and maintains the port rules itself; on a traditional OS the platform
cannot do that, so the requirement is relaxed and the missing information is documented.

Disabled remains the default and the recommended configuration. What changes is that
keeping a mechanism enabled is now a documented customer choice instead of a violation.

All three mechanisms are treated the same way. AppArmor is not singled out: the DISA STIG
for Canonical Ubuntu 22.04 LTS requires it (V-260557), and Ubuntu enables it by default, so
demanding that it stay off was neither defensible nor enforceable.

What

A. Security mechanisms (node_preprocessing.mdx)

• Reworked the security-mechanism check and the cross-node firewall check.
• New appendix Hardened Node Security Configuration. Its primary path is not to
  re-enable a mechanism after the fact. init.sh supports per-step skipping — verified
  against installer/res/init.sh in the shipped package, where every disable_* function
  guards on _skip "${FUNCNAME[0]}" — so the appendix tells the reader to pass
  --skip-disable_selinux, --skip-disable_apparmor, --skip-disable_firewalld or
  --skip-disable_ufw and keep the node in the state it was installed with. That avoids a
  full SELinux relabel and the extra reboot entirely.
• Recovering a node that already ran the full init.sh is documented separately, and
  relabels under permissive before switching to enforcing. Booting straight into
  enforcing on a freshly relabelled file system can leave the node unbootable or refuse
  SSH logins if the relabel was incomplete. The recovery path also covers the apparmor=0
  kernel command-line argument that init.sh can add and that a service restart does not
  clear.

B. Communication matrix (communication_matrix.mdx, new)

• The port list previously existed only on the internal wiki, so customers who enabled a
  host firewall had no way to know which ports to allow.
• States its scope: core components and Aligned extensions. Ports required by Agnostic
  extensions are maintained by those extensions.
• States explicitly that it is not a complete firewall configuration, and lists what it
  does not cover — Pod and Service traffic, secondary or non-default container networks,
  load balancer forwarding, Self-built VIP keepalived VRRP, global disaster recovery, and
  global-to-workload traffic — each pointing at the page that owns that requirement.

C. Supported OS list synced with the internal release baseline

• Defect-level fix. The Kylin V10 SP3 kernel was documented as
  4.19.90-52.22.v2207.ky10.*. That kernel has a known defect (pipe wakeup handling) that
  can hang the OVS revalidator and break Pod DNS resolution. Corrected to the
  V10 SP3 2403 release and 4.19.90-89.11.v2401.ky10.*, and a minimum build is now
  recommended in the info block, because the page's kernel rule only pins x.y.z and both
  builds share 4.19.90.
• Added Kylin V11 2503 (x86 and ARM), which was entirely missing from the docs.
• RHEL 8 is a range 8.0 to 8.6, matching the internal baseline and the existing CentOS
  entry on the same page, not two discrete versions.
• The kernel-matching rule now also covers an entry that names a release without a kernel
  value, which is the form the new Kylin V11 2503 rows use.

D. on-premises.mdx — removed the obsolete port 11781 from the load balancer
forwarding requirement and from the global-to-workload access requirement. Confirmed with
the component owner: 11781 was the old HTTPS monitoring port and is no longer used; only
11780 is required.

Reviewer notes

• Kylin V11 is listed without a patch-level boundary. ACP forbids feature changes in patch
  releases, so validation on one patch covers the whole minor line.
• The hardened-configuration appendix carries an extra clause that 4.4/master does not: the
  configuration is not validated on every operating system in this version's support list.
• Astra is intentionally not documented here; it stays an internal, on-demand delivery item.
• Ports for Agnostic extensions (Ceph, Kafka, ZooKeeper, CSI NFS) are intentionally not
  in the matrix. Those are maintained by the extensions themselves.
• Fixed the CentOS entry, which listed 3.10.0-1127 twice. The baseline gives
  3.10.0-1127 and 3.10.0-1160.
• Added Flannel is not supported on Kylin V11 to both Kylin entries. Flannel is still a
  cluster-creation option on this line, so adding V11 to the support list made an
  unsupported combination reachable with nothing warning against it. The note is not added
  on 4.2 and later, where Flannel is not supported at all.
• Open questions for the matrix owner, deliberately not changed here. 17946 is listed
  as TCP only; upstream MetalLB memberlist uses TCP and UDP on the same port, but whether
  ACP's deployment enables memberlist has not been verified. 7473 (frr-metrics) is
  carried over unchanged, although the two sibling MetalLB ports are the upstream default
  plus 10000 (7472→17472, 7946→17946) and this one is not. 2049 (nfs) has no
  identified owning component.
• Validated with yarn install + yarn lint: 0 errors, 0 warnings.

[cloudflare-workers-and-pages]

Deploying alauda-container-platform with    Cloudflare Pages

Latest commit:	99c7095
Status:	✅  Deploy successful!
Preview URL:	https://3324004d.alauda-container-platform.pages.dev
Branch Preview URL:	https://docs-ait-73853-node-security.alauda-container-platform.pages.dev

View logs