OpenControls Logo

STIG Viewer

STIGViewer Support

Rancher RKE2 must be built from verified packages.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-268321CNTR-R2-000460SV-268321r1017019_ruleCCI-001749medium
Description
Only RKE2 images that have been properly signed by Rancher Government's authorized key will be deployed to ensure the cluster's security and compliance with organizational policies.
STIGDate
Rancher Government Solutions RKE2 Security Technical Implementation Guide2026-05-13

Related Frameworks

1 mapping across 2 frameworks
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(10)Shared and Group Account Credential Change
1.00
AU-4Audit Log Storage Capacity
1.00
CM-14Signed Components
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(3)Signed Components
1.00
CM-7Least Functionality
1.00
CM-7(5)Authorized Software — Allow-by-exception
1.00
IA-2(5)Individual Authentication with Group Authentication
1.00
SC-2Separation of System and User Functionality
1.00
SC-23Session Authenticity
1.00

+2 more (top 10 by confidence shown)

CCI1 mapping
CCI-001749
1.00

Details

Check Text (C-268321r1017019_chk)

Utilizing Hauler (https://hauler.dev), ensure all RKE2 Kubernetes Container images running in the RKE2 cluster have been obtained and their signatures have been validated and signed by Rancher Government Solutions Private Key. For reference, the public key is available at: https://raw.githubusercontent.com/rancherfederal/carbide-releases/main/carbide-key.pub For more information about verifying the signatures of Carbide images, including RKE2, see: https://rancherfederal.github.io/carbide-docs/docs/registry-docs/validating-images If any RKE2 images are identified as not being signed by the Rancher Government Solutions' private key, this is a finding.

Fix Text (F-72245r1017018_fix)

Immediate action must be taken to remove non-verifiable images from the cluster and replace them with verifiable images. Utilize Hauler (https://hauler.dev) to pull and verify RKE2 images from Rancher Government Solutions Carbide Repository. For more information about pulling Carbide images and their signatures, including RKE2, see: https://rancherfederal.github.io/carbide-docs/docs/registry-docs/downloading-images