STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.

DISA Rule

SV-254553r1188297_rule

Vulnerability Number

V-254553

Group Title

SRG-APP-000014-CTR-000035

Rule Version

CNTR-R2-000010

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Configure the use of strong TLS settings.

Edit the RKE2 server configuration file on all RKE2 server hosts, located at "/etc/rancher/rke2/config.yaml", to contain the following:

kube-controller-manager-arg:

"tls-min-version=VersionTLS12" [or higher]
"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" kube-scheduler-arg:
"tls-min-version=VersionTLS12"
"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" kube-apiserver-arg:
"tls-min-version=VersionTLS12"
"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"

Once the configuration file is updated, restart the RKE2 server using the command:

systemctl restart rke2-server

Check Contents

Use strong TLS settings.

On the RKE2 server, run each command:

/bin/ps -ef | grep kube-apiserver | grep -v grep

/bin/ps -ef | grep kube-controller-manager | grep -v grep

/bin/ps -ef | grep kube-scheduler | grep -v grep

For each, look for the existence of tls-min-version (use this command for an aid "| grep tls-min-version").

If the setting "tls-min-version" is not configured or it is set to "VersionTLS10" or "VersionTLS11", this is a finding.

For each, look for the existence of the tls-cipher-suites.

If "tls-cipher-suites" is not set for all servers, or does not contain the following, this is a finding.

--tls-cipher-suites=suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

Vulnerability Number

V-254553

Documentable

False

Rule Version

CNTR-R2-000010

Severity Override Guidance

Use strong TLS settings.

On the RKE2 server, run each command:

/bin/ps -ef | grep kube-apiserver | grep -v grep

/bin/ps -ef | grep kube-controller-manager | grep -v grep

/bin/ps -ef | grep kube-scheduler | grep -v grep

For each, look for the existence of tls-min-version (use this command for an aid "| grep tls-min-version").

If the setting "tls-min-version" is not configured or it is set to "VersionTLS10" or "VersionTLS11", this is a finding.

For each, look for the existence of the tls-cipher-suites.

If "tls-cipher-suites" is not set for all servers, or does not contain the following, this is a finding.

--tls-cipher-suites=suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

Check Content Reference

M

Target Key

5486