OpenControls Logo

STIG Viewer

STIGViewer Support

Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-254572CNTR-R2-001270SV-254572r1208192_ruleCCI-003980medium
Description
Controlling access to users and roles responsible for patching and updating RKE2 reduces the risk of untested or potentially malicious software from being installed within the platform. This access may be separate from the access required to install container images into the registry and access requirements required to instantiate an image into a service. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user. Kubernetes uses the API Server to control communication to the other services that make up Kubernetes. The use of authorizations and not the default of "AlwaysAllow" enables the Kubernetes functions control to only the groups that need them. To control access, the API server can be configured with the following flags for authorization-mode: (Note: For this STIG, the setting must be "RBAC" or "Node".) --authorization-mode=ABAC (Attribute-Based Access Control [ABAC] mode allows a user to configure policies using local files.) --authorization-mode=RBAC (Role-based access control [RBAC] mode allows a user to create and store policies using the Kubernetes API.) --authorization-mode=Webhook (WebHook is an HTTP callback mode that allows a user to manage authorization using a remote REST endpoint.) --authorization-mode=Node (Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.) --authorization-mode=AlwaysDeny (This flag blocks all requests. Use this flag only for testing.) Satisfies: SRG-APP-000378-CTR-000880, SRG-APP-000378-CTR-000885
STIGDate
Rancher Government Solutions RKE2 Security Technical Implementation Guide2026-05-13

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-05User-Installed Software
0.50
CFG-05.2Restrict Roles Permitted To Install Software
0.50
END-03Prohibit Installation Without Privileged Status
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (42) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+32 more (top 10 by confidence shown)

CCI2 mappings
CCI-001812
1.00
CCI-003980
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.PS-05
0.50

Details

Check Text (C-254572r1208192_chk)

Ensure authorization-mode is set correctly in the apiserver. Run this command on all RKE2 Control Plane hosts: /bin/ps -ef | grep kube-apiserver | grep -v grep If --authorization-mode is not set to "RBAC,Node" or is not configured, this is a finding. (By default, RKE2 sets Node,RBAC as the parameter to the --authorization-mode argument.)

Fix Text (F-58005r1208191_fix)

Edit the RKE2 Server configuration file on all RKE2 Control Plane hosts, located at /etc/rancher/rke2/config.yaml, to contain the following: kube-apiserver-arg: --authorization-mode=RBAC,Node Once the configuration file is updated, restart the RKE2 Server. Run the command: systemctl restart rke2-server