STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.

DISA Rule

SV-254555r1188300_rule

Vulnerability Number

V-254555

Group Title

SRG-APP-000026-CTR-000070

Rule Version

CNTR-R2-000060

Severity

CAT II

CCI(s)

• CCI-000018 - Automatically audit account creation actions.
• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000366 - Implement the security configuration settings.
• CCI-001403 - Automatically audit account modification actions.
• CCI-001404 - Automatically audit account disabling actions.
• CCI-001464 - Initiates session audits automatically at system start-up.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-003938 - Automatically generate audit records of the enforcement actions.
• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
• CCI-001889 - Record time stamps for audit records that meet organization-defined granularity of time measurement.
• CCI-001890 - Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
• CCI-002130 - Automatically audit account enabling actions.
• CCI-002234 - Log the execution of privileged functions.
• CCI-002884 - Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Edit the "/etc/rancher/rke2/config.yaml" file and enable the audit-policy-file: /etc/rancher/rke2/audit-policy.yaml

Edit the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, so it contains the required configuration.

--audit-policy-file= Path to the file that defines the audit policy configuration. (Example: /etc/rancher/rke2/audit-policy.yaml) --audit-log-mode=blocking-strict

If configuration file is updated, restart the RKE2 using the command "systemctl restart rke2-server" for server hosts or "systemctl restart rke2-agent" for agent hosts.

Edit the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, so that it contains required configuration.

If using RKE2 v1.24 or older, set: profile: cis-1.6

If using RKE2 v1.25 or newer, set: profile: cis-1.23

For October 2023 releases (v1.25.15+rke2r1, v1.26.10+rke2r1, v1.27.7+rke2r1, v1.28.3+rke2r1), use the generic profile "cis".

If configuration file is updated, restart RKE2 using the command "systemctl restart rke2-server" for server hosts or "systemctl restart rke2-agent" for agent hosts.

Edit the audit policy file, by default, located at /etc/rancher/rke2/audit-policy.yaml to look like the following:

apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: rke2-audit-policy rules:

level: Metadata resources:
group: "" resources: ["secrets"]
level: RequestResponse resources:
group: "" resources: ["*"]

If configuration files are updated on a host, restart the RKE2 service using the command "systemctl restart rke2-server" for server hosts and "systemctl restart rke2-agent" for agent hosts.

Check Contents

Audit logging and policies:

On all hosts running RKE2, run the command:

/bin/ps -ef | grep kube-apiserver | grep -v grep

If --audit-policy-file is not set, this is a finding. If --audit-log-mode is not = "blocking-strict", this is a finding.

Ensure the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, contains CIS profile setting. Run the following command: cat /etc/rancher/rke2/config.yaml
RKE2 can be started with the profile flag set to cis, cis-1.23, or cis-1.6 depending on the RKE2 version. Available with October 2023 releases (v1.25.15+rke2r1, v1.26.10+rke2r1, v1.27.7+rke2r1, v1.28.3+rke2r1), use the generic profile: "cis".

If a value for profile is not found or is not set correctly, this is a finding. (Example: "profile: cis")

Check the contents of the audit-policy file. By default, RKE2 expects the audit-policy file to be located at /etc/rancher/rke2/audit-policy.yaml; however, this location can be overridden in the /etc/rancher/rke2/config.yaml file with argument 'kube-apiserver-arg: "audit-policy-file=/etc/rancher/rke2/audit-policy.yaml"'.
If the audit policy file does not exist or does not look like the following, this is a finding.

apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: rke2-audit-policy rules:

level: Metadata resources:
group: "" resources: ["secrets"]
level: RequestResponse resources:
group: "" resources: ["*"]

Vulnerability Number

V-254555

Documentable

False

Rule Version

CNTR-R2-000060

Severity Override Guidance

Audit logging and policies:

On all hosts running RKE2, run the command:

/bin/ps -ef | grep kube-apiserver | grep -v grep

If --audit-policy-file is not set, this is a finding. If --audit-log-mode is not = "blocking-strict", this is a finding.

Ensure the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, contains CIS profile setting. Run the following command: cat /etc/rancher/rke2/config.yaml
RKE2 can be started with the profile flag set to cis, cis-1.23, or cis-1.6 depending on the RKE2 version. Available with October 2023 releases (v1.25.15+rke2r1, v1.26.10+rke2r1, v1.27.7+rke2r1, v1.28.3+rke2r1), use the generic profile: "cis".

If a value for profile is not found or is not set correctly, this is a finding. (Example: "profile: cis")

Check the contents of the audit-policy file. By default, RKE2 expects the audit-policy file to be located at /etc/rancher/rke2/audit-policy.yaml; however, this location can be overridden in the /etc/rancher/rke2/config.yaml file with argument 'kube-apiserver-arg: "audit-policy-file=/etc/rancher/rke2/audit-policy.yaml"'.
If the audit policy file does not exist or does not look like the following, this is a finding.

apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: rke2-audit-policy rules:

level: Metadata resources:
group: "" resources: ["secrets"]
level: RequestResponse resources:
group: "" resources: ["*"]

Check Content Reference

M

Target Key

5486