OpenControls Logo

STIG Viewer

STIGViewer Support

Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-254572CNTR-R2-001270SV-254572r1016560_ruleCCI-003980medium
Description
Controlling access to those users and roles responsible for patching and updating RKE2 reduces the risk of untested or potentially malicious software from being installed within the platform. This access may be separate from the access required to install container images into the registry and those access requirements required to instantiate an image into a service. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user. Kubernetes uses the API Server to control communication to the other services that makeup Kubernetes. The use of authorizations and not the default of "AlwaysAllow" enables the Kubernetes functions control to only the groups that need them. To control access, the API server must have one of the following options set for the authorization mode: --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode allows a user to configure policies using local files. --authorization-mode=RBAC Role-based access control (RBAC) mode allows a user to create and store policies using the Kubernetes API. --authorization-mode=Webhook WebHook is an HTTP callback mode that allows a user to manage authorization using a remote REST endpoint. --authorization-mode=Node Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets. --authorization-mode=AlwaysDeny This flag blocks all requests. Use this flag only for testing. Satisfies: SRG-APP-000378-CTR-000880, SRG-APP-000378-CTR-000885
STIGDate
Rancher Government Solutions RKE2 Security Technical Implementation Guide2024-12-20

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-05User-Installed Software
0.50
CFG-05.2Restrict Roles Permitted To Install Software
0.50
END-03Prohibit Installation Without Privileged Status
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (42) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+32 more (top 10 by confidence shown)

CCI2 mappings
CCI-001812
1.00
CCI-003980
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.PS-05
0.50

Details

Check Text (C-254572r1016560_chk)

Ensure authorization-mode is set correctly in the apiserver. Run this command on all RKE2 Control Plane hosts: /bin/ps -ef | grep kube-apiserver | grep -v grep If --authorization-mode is not set to "RBAC,Node" or is not configured, this is a finding. (By default, RKE2 sets Node,RBAC as the parameter to the --authorization-mode argument.)

Fix Text (F-58005r1016541_fix)

Edit the RKE2 Server configuration file on all RKE2 Control Plane hosts, located at /etc/rancher/rke2/config.yaml, to contain the following: kube-apiserver-arg: --authorization-mode=RBAC,Node Once configuration file is updated, restart the RKE2 Server. Run the command: systemctl restart rke2-server