STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after five minutes of inactivity.

DISA Rule

SV-254568r1188305_rule

Vulnerability Number

V-254568

Group Title

SRG-APP-000190-CTR-000500

Rule Version

CNTR-R2-000890

Severity

CAT II

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Edit the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:

kubelet-arg: --streaming-connection-idle-timeout=5m

If configuration files are updated on a host, restart the RKE2 service using the command "systemctl restart rke2-server" for server hosts and "systemctl restart rke2-agent" for agent hosts.

Check Contents

Ensure streaming-connection-idle-timeout argument is set correctly.

Run this command on each node:
/bin/ps -ef | grep kubelet | grep -v grep

If --streaming-connection-idle-timeout is set to < "5m", missing or the parameter is not configured, this is a finding.

Vulnerability Number

V-254568

Documentable

False

Rule Version

CNTR-R2-000890

Severity Override Guidance

Ensure streaming-connection-idle-timeout argument is set correctly.

Run this command on each node:
/bin/ps -ef | grep kubelet | grep -v grep

If --streaming-connection-idle-timeout is set to < "5m", missing or the parameter is not configured, this is a finding.

Check Content Reference

M

Target Key

5486