STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

The Kubernetes Kubelet must have the read-only port flag disabled.

DISA Rule

SV-254559r1188303_rule

Vulnerability Number

V-254559

Group Title

SRG-APP-000033-CTR-000095

Rule Version

CNTR-R2-000130

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Edit the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, to contain the following: kubelet-arg: --read-only-port=0

If configuration files are updated on a host, restart the RKE2 service using the command "systemctl restart rke2-server" for server hosts and "systemctl restart rke2-agent" for agent hosts.

Check Contents

Ensure read-only-port is set so anonymous requests will be rejected.

Run the following command on each node:

/bin/ps -ef | grep kubelet | grep -v grep

If --read-only-port is not set to "0" or is not configured, this is a finding.

Vulnerability Number

V-254559

Documentable

False

Rule Version

CNTR-R2-000130

Severity Override Guidance

Ensure read-only-port is set so anonymous requests will be rejected.

Run the following command on each node:

/bin/ps -ef | grep kubelet | grep -v grep

If --read-only-port is not set to "0" or is not configured, this is a finding.

Check Content Reference

M

Target Key

5486