STIGQter STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 runtime must isolate security functions from nonsecurity functions.

DISA Rule

SV-254569r1188307_rule

Vulnerability Number

V-254569

Group Title

SRG-APP-000233-CTR-000585

Rule Version

CNTR-R2-000940

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:

kubelet-arg: --protect-kernel-defaults=true

If configuration files are updated on a host, restart the RKE2 service using the command "systemctl restart rke2-server" for server hosts and "systemctl restart rke2-agent" for agent hosts.

Check Contents

Ensure protect-kernel-defaults argument is set correctly.

Run this command on each node:
/bin/ps -ef | grep kubelet | grep -v grep

If --protect-kernel-defaults is not set to "true", missing or is not configured, this is a finding.

Vulnerability Number

V-254569

Documentable

False

Rule Version

CNTR-R2-000940

Severity Override Guidance

Ensure protect-kernel-defaults argument is set correctly.

Run this command on each node:
/bin/ps -ef | grep kubelet | grep -v grep

If --protect-kernel-defaults is not set to "true", missing or is not configured, this is a finding.

Check Content Reference

M

Target Key

5486