OpenControls Logo

STIG Viewer

STIGViewer Support

Rancher RKE2 must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-254571CNTR-R2-001130SV-254571r1156616_ruleCCI-002233medium
Description
Admission controllers intercept requests to the Kubernetes API before an object is instantiated. Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated or deleted. Admissions controllers can be used for: - Prevent pod’s ability to run privileged containers - Prevent pod’s ability to use privileged escalation - Controlling pod’s access to volume types - Controlling pod’s access to host file system - Controlling pod’s usage of host networking objects and configuration Satisfies: SRG-APP-000340-CTR-000770, SRG-APP-000342-CTR-000775
STIGDate
Rancher Government Solutions RKE2 Security Technical Implementation Guide2026-05-13

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.5Prohibit Non-Privileged Users from Executing Privileged Functions
1.00
IAC-21.7Privilege Levels for Code Execution
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (55) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+45 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7
1.00
CCI2 mappings
CCI-002233
1.00
CCI-002235
1.00

Details

Check Text (C-254571r1156616_chk)

On each controlplane node, retrieve the "pod-security-admission-config-file" value from the RKE2 config file (/etc/rancher/rke2/config.yaml). For example: pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml Validate that the file referenced by "pod-security-admission-config-file" exists and the default configuration settings match the following: defaults: audit: restricted audit-version: latest enforce: restricted enforce-version: latest warn: restricted warn-version: latest If "pod-security-admission-config-file" is not set, the file does not exist, or the configuration file differs from the above, this is a finding.

Fix Text (F-58004r1156615_fix)

On each Control Plane node, create the file "/etc/rancher/rke2/rke2-pss-custom.yaml" and add the following content: apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1beta1 kind: PodSecurityConfiguration defaults: enforce: "restricted" enforce-version: "latest" audit: "restricted" audit-version: "latest" warn: "restricted" warn-version: "latest" exemptions: usernames: [] runtimeClasses: [] namespaces: [kube-system, cis-operator-system, tigera-operator] Verify the namespace exemptions contain only namespaces requiring access to capabilities outside of the restricted settings above. Once the file is created, add the following to the RKE2 config file (/etc/rancher/rke2/config.yaml): pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml Once the "pod-security-admission-config-file" has been added, restart the Control Plane nodes with: systemctl restart rke2-server