STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 must be configured with only essential configurations.

DISA Rule

SV-254565r1208189_rule

Vulnerability Number

V-254565

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-R2-000550

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.
• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

Disable unnecessary RKE2 components.

Edit the RKE2 Server configuration file on all RKE2 Server hosts, located at /etc/rancher/rke2/config.yaml, so that it contains a "disable" flag if any default RKE2 components are unnecessary.

Example:
disable:
- rke2-canal
- rke2-ingress-nginx
- rke2-kube-proxy
- rke2-metrics-server
- rke2-coredns

Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server

Check Contents

Ensure the RKE2 Server configuration file on all RKE2 Server hosts contains a "disable" flag only if there are default RKE2 components that need to be disabled.

If there are no default components that need to be disabled, this is not a finding.

Run this command on the RKE2 Control Plane:
cat /etc/rancher/rke2/config.yaml

RKE2 allows disabling the following components. If any of the components are not required, they can be disabled:
- rke2-canal
- rke2-coredns
- rke2-ingress-nginx
- rke2-kube-proxy
- rke2-metrics-server

If services not in use are enabled, this is a finding.

Vulnerability Number

V-254565

Documentable

False

Rule Version

CNTR-R2-000550

Severity Override Guidance

Ensure the RKE2 Server configuration file on all RKE2 Server hosts contains a "disable" flag only if there are default RKE2 components that need to be disabled.

If there are no default components that need to be disabled, this is not a finding.

Run this command on the RKE2 Control Plane:
cat /etc/rancher/rke2/config.yaml

RKE2 allows disabling the following components. If any of the components are not required, they can be disabled:
- rke2-canal
- rke2-coredns
- rke2-ingress-nginx
- rke2-kube-proxy
- rke2-metrics-server

If services not in use are enabled, this is a finding.

Check Content Reference

M

Target Key

5486