| V-254554 | | RKE2 must use a centralized user management solution to support account management functions. | The Kubernetes Controller Manager is a background process that embeds core control loops regulating cluster system state through the API Server. Every... |
| V-254555 | | Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs. | Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of re-establishing access. One way to accom... |
| V-254556 | | The Kubernetes Controller Manager must have secure binding. | Limiting the number of attack vectors and implementing authentication and encryption on the endpoints available to external sources is paramount when ... |
| V-254557 | | The Kubernetes Kubelet must have anonymous authentication disabled. | RKE2 registry is used to store images and is the keeper of truth for trusted images within the platform. To guarantee the images' integrity, access to... |
| V-254563 | | All audit records must identify any containers associated with the event within Rancher RKE2. | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate.
Retaining logs for at least 30 days ensures that you can go back in time ... |
| V-254564 | | Configuration and authentication files for Rancher RKE2 must be protected. | There are various configuration files, logs, access credentials, and other files stored on the host filesystem that contain sensitive information.
T... |
| V-254565 | | Rancher RKE2 must be configured with only essential configurations. | It is important to disable any unnecessary components to reduce any potential attack surfaces.
RKE2 allows disabling the following components:
- rke... |
| V-254566 | | Rancher RKE2 runtime must enforce ports, protocols, and services that adhere to the PPSM CAL. | Ports, protocols, and services within the RKE2 runtime must be controlled and conform to the PPSM CAL. Those ports, protocols, and services that fall ... |
| V-254567 | | Rancher RKE2 must store only cryptographic representations of passwords. | Secrets, such as passwords, keys, tokens, and certificates should not be stored as environment variables. These environment variables are accessible i... |
| V-254568 | | Rancher RKE2 must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after five minutes of inactivity. | Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management se... |
| V-254569 | | Rancher RKE2 runtime must isolate security functions from nonsecurity functions. | RKE2 runs as isolated as possible.
RKE2 is a container-based Kubernetes distribution. A container image is essentially a complete and executable vers... |
| V-254570 | | Rancher RKE2 runtime must maintain separate execution domains for each container by assigning each container a separate address space to prevent unauthorized and unintended information transfer via shared system resources. | Separating user functionality from management functionality is a requirement for all the components within the Kubernetes Control Plane. Without the s... |
| V-254571 | | Rancher RKE2 must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. | Admission controllers intercept requests to the Kubernetes API before an object is instantiated. Enabling the admissions webhook allows for Kubernetes... |
| V-254572 | | Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status. | Controlling access to those users and roles responsible for patching and updating RKE2 reduces the risk of untested or potentially malicious software ... |
| V-254574 | | Rancher RKE2 must remove old components after updated versions have been installed. | Previous versions of Rancher RKE2 components that are not removed after updates have been installed may be exploited by adversaries by causing older c... |
| V-254575 | | Rancher RKE2 registry must contain the latest images with most recent updates and execute within Rancher RKE2 runtime as authorized by IAVM, CTOs, DTMs, and STIGs. | Software supporting RKE2, images in the registry must stay up to date with the latest patches, service packs, and hot fixes. Not updating RKE2 and con... |
| V-268321 | | Rancher RKE2 must be built from verified packages. | Only RKE2 images that have been properly signed by Rancher Government's authorized key will be deployed to ensure the cluster's security and complianc... |
| V-254553 | | Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules. | Use strong TLS settings.
RKE2 uses FIPS validated BoringCrypto modules. RKE2 Server can prohibit the use of SSL and unauthorized versions of TLS prot... |
| V-254558 | | The Kubernetes API server must have the insecure port flag disabled. | By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also ... |
| V-254559 | | The Kubernetes Kubelet must have the read-only port flag disabled. | Kubelet serves a small REST API with read access to port 10255. The read-only port for Kubernetes provides no authentication or authorization security... |
| V-254560 | | The Kubernetes API server must have the insecure bind address not set. | By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the "insecure bin... |
| V-254561 | | The Kubernetes kubelet must enable explicit authorization. | Kubelet is the primary agent on each node. The API server communicates with each kubelet to perform tasks such as starting/stopping pods. By default, ... |
| V-254562 | | The Kubernetes API server must have anonymous authentication disabled. | The Kubernetes API Server controls Kubernetes via an API interface. A user who has access to the API essentially has root access to the entire Kuberne... |
| V-254573 | | Rancher RKE2 keystore must implement encryption to prevent unauthorized disclosure of information at rest within Rancher RKE2. | Encrypting secrets at rest in etcd.
By default, RKE2 will create an encryption key and configuration file and pass these to the Kubernetes API server... |
