STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 runtime must maintain separate execution domains for each container by assigning each container a separate address space to prevent unauthorized and unintended information transfer via shared system resources.

DISA Rule

SV-254570r1137645_rule

Vulnerability Number

V-254570

Group Title

SRG-APP-000243-CTR-000600

Rule Version

CNTR-R2-000970

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.
• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.
• CCI-002530 - Maintain a separate execution domain for each executing system process.

Weight

10

Fix Recommendation

System namespaces are reserved and isolated.

A resource cannot move to a new namespace; the resource must be deleted and recreated in the new namespace.

kubectl delete <resource_type> <resource_name>
kubectl create -f <resource.yaml> --namespace=<user_created_namespace>

Check Contents

System namespaces are reserved and isolated.

To view the available namespaces, run the command:
kubectl get namespaces

The namespaces to be validated include:
default
kube-public
kube-system
kube-node-lease

For the default namespace, execute the commands:
kubectl config set-context --current --namespace=default
kubectl get all

For the kube-public namespace, execute the commands:
kubectl config set-context --current --namespace=kube-public
kubectl get all

For the kube-node-lease namespace, execute the commands:
kubectl config set-context --current --namespace=kube-node-lease
kubectl get all

The only return values are the Kubernetes service objects (e.g., service/kubernetes).

For the kube-system namespace, execute the commands:
kubectl config set-context --current --namespace=kube-system
kubectl get all

The values returned include the following resources:
- ETCD
- Helm
- Kubernetes API Server
- Kubernetes Controller Manager
- Kubernetes Proxy
- Kubernetes Scheduler
- Kubernetes Networking Components
- Ingress Controller Components
- Metrics Server

If a return value from the "kubectl get all" command is not the Kubernetes service, one from the above lists, or a service otherwise approved by your Information Systems Security Officer (ISSO), this is a finding.

Vulnerability Number

V-254570

Documentable

False

Rule Version

CNTR-R2-000970

Severity Override Guidance

System namespaces are reserved and isolated.

To view the available namespaces, run the command:
kubectl get namespaces

The namespaces to be validated include:
default
kube-public
kube-system
kube-node-lease

For the default namespace, execute the commands:
kubectl config set-context --current --namespace=default
kubectl get all

For the kube-public namespace, execute the commands:
kubectl config set-context --current --namespace=kube-public
kubectl get all

For the kube-node-lease namespace, execute the commands:
kubectl config set-context --current --namespace=kube-node-lease
kubectl get all

The only return values are the Kubernetes service objects (e.g., service/kubernetes).

For the kube-system namespace, execute the commands:
kubectl config set-context --current --namespace=kube-system
kubectl get all

The values returned include the following resources:
- ETCD
- Helm
- Kubernetes API Server
- Kubernetes Controller Manager
- Kubernetes Proxy
- Kubernetes Scheduler
- Kubernetes Networking Components
- Ingress Controller Components
- Metrics Server

If a return value from the "kubectl get all" command is not the Kubernetes service, one from the above lists, or a service otherwise approved by your Information Systems Security Officer (ISSO), this is a finding.

Check Content Reference

M

Target Key

5486