STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

All audit records must identify any containers associated with the event within Rancher RKE2.

DISA Rule

SV-254563r960906_rule

Vulnerability Number

V-254563

Group Title

SRG-APP-000100-CTR-000200

Rule Version

CNTR-R2-000320

Severity

CAT II

CCI(s)

• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Weight

10

Fix Recommendation

Edit the RKE2 Configuration File /etc/rancher/rke2/config.yaml on the RKE2 Control Plane and set the following "kube-apiserver-arg" argument:

- audit-log-maxage=30

Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server

Check Contents

Ensure audit-log-maxage is set correctly.

Run the below command on the RKE2 Control Plane:
/bin/ps -ef | grep kube-apiserver | grep -v grep

If --audit-log-maxage argument is not set to at least 30 or is not configured, this is a finding.
(By default, RKE2 sets the --audit-log-maxage argument parameter to 30.)

Vulnerability Number

V-254563

Documentable

False

Rule Version

CNTR-R2-000320

Severity Override Guidance

Ensure audit-log-maxage is set correctly.

Run the below command on the RKE2 Control Plane:
/bin/ps -ef | grep kube-apiserver | grep -v grep

If --audit-log-maxage argument is not set to at least 30 or is not configured, this is a finding.
(By default, RKE2 sets the --audit-log-maxage argument parameter to 30.)

Check Content Reference

M

Target Key

5486