STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

RKE2 must use a centralized user management solution to support account management functions.

DISA Rule

SV-254554r1043176_rule

Vulnerability Number

V-254554

Group Title

SRG-APP-000023-CTR-000055

Rule Version

CNTR-R2-000030

Severity

CAT II

CCI(s)

• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

Edit the RKE2 Configuration File /etc/rancher/rke2/config.yaml on the RKE2 Control Plane and set the following "kube-controller-manager-arg" argument:
- use-service-account-credentials=true

Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server

Check Contents

Ensure use-service-account-credentials argument is set correctly.

Run this command on the RKE2 Control Plane:
/bin/ps -ef | grep kube-controller-manager | grep -v grep

If --use-service-account-credentials argument is not set to "true" or is not configured, this is a finding.

Vulnerability Number

V-254554

Documentable

False

Rule Version

CNTR-R2-000030

Severity Override Guidance

Ensure use-service-account-credentials argument is set correctly.

Run this command on the RKE2 Control Plane:
/bin/ps -ef | grep kube-controller-manager | grep -v grep

If --use-service-account-credentials argument is not set to "true" or is not configured, this is a finding.

Check Content Reference

M

Target Key

5486