OpenControls Logo

STIG Viewer

STIGViewer Support

Rancher RKE2 keystore must implement encryption to prevent unauthorized disclosure of information at rest within Rancher RKE2.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-254573CNTR-R2-001500SV-254573r1050650_ruleCCI-002476high
Description
Encrypting secrets at rest in etcd. By default, RKE2 will create an encryption key and configuration file and pass these to the Kubernetes API server. The result is that RKE2 automatically encrypts Kubernetes Secret objects when writing them to etcd.
STIGDate
Rancher Government Solutions RKE2 Security Technical Implementation Guide2024-12-20

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-11.4Cryptographic Protection
0.50
CRY-04Transmission Integrity
0.50
CRY-05Encrypting Data At Rest
0.50
DCH-07.2Encrypting Data In Storage Media
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (18) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
AU-1Policy and Procedures
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
IA-5(1)Password-based Authentication
1.00
IA-7Cryptographic Module Authentication
1.00
SC-12(2)Symmetric Keys
1.00
SC-12(3)Asymmetric Keys
1.00
SC-13Cryptographic Protection
1.00

+8 more (top 10 by confidence shown)

CCI1 mapping
CCI-002476
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50

Details

Check Text (C-254573r1050650_chk)

This is Not Applicable for RKE2 versions 1.20 and greater. Review the encryption configuration file. As root or with root permissions, run the following command: view /var/lib/rancher/rke2/server/cred/encryption-config.json Ensure the RKE2 configuration file on all RKE2 servers, located at /etc/rancher/rke2/config.yaml, does NOT contain: secrets-encryption: false If secrets encryption is turned off, this is a finding.

Fix Text (F-58006r1016544_fix)

This is Not Applicable for RKE2 versions 1.20 and greater. Enable secrets encryption. Edit the RKE2 configuration file on all RKE2 servers, located at /etc/rancher/rke2/config.yaml, so that it contains: secrets-encryption: true