STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

The Kubernetes kubelet must enable explicit authorization.

DISA Rule

SV-254561r1137639_rule

Vulnerability Number

V-254561

Group Title

SRG-APP-000033-CTR-000095

Rule Version

CNTR-R2-000150

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Edit the RKE2 Configuration File /etc/rancher/rke2/config.yaml on every RKE2 node and set the following "kubelet-arg" argument:

- authorization-mode=Webhook

Once the configuration file is updated, restart the RKE2 Server or Agent. Run the command:
systemctl restart rke2-server or systemctl restart rke2-agent

Check Contents

Ensure authorization-mode is set correctly in the kubelet on each rke2 node.

Run this command on each node:
/bin/ps -ef | grep kubelet | grep -v grep

If --authorization-mode is not set to "Webhook" or is not configured, this is a finding.

Vulnerability Number

V-254561

Documentable

False

Rule Version

CNTR-R2-000150

Severity Override Guidance

Ensure authorization-mode is set correctly in the kubelet on each rke2 node.

Run this command on each node:
/bin/ps -ef | grep kubelet | grep -v grep

If --authorization-mode is not set to "Webhook" or is not configured, this is a finding.

Check Content Reference

M

Target Key

5486