STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

DISA Rule

SV-254571r1156616_rule

Vulnerability Number

V-254571

Group Title

SRG-APP-000340-CTR-000770

Rule Version

CNTR-R2-001130

Severity

CAT II

CCI(s)

• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.
• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

On each Control Plane node, create the file "/etc/rancher/rke2/rke2-pss-custom.yaml" and add the following content:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1beta1
kind: PodSecurityConfiguration
defaults:
enforce: "restricted"
enforce-version: "latest"
audit: "restricted"
audit-version: "latest"
warn: "restricted"
warn-version: "latest"
exemptions:
usernames: []
runtimeClasses: []
namespaces: [kube-system, cis-operator-system, tigera-operator]

Verify the namespace exemptions contain only namespaces requiring access to capabilities outside of the restricted settings above.

Once the file is created, add the following to the RKE2 config file (/etc/rancher/rke2/config.yaml):

pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml

Once the "pod-security-admission-config-file" has been added, restart the Control Plane nodes with:

systemctl restart rke2-server

Check Contents

On each controlplane node, retrieve the "pod-security-admission-config-file" value from the RKE2 config file (/etc/rancher/rke2/config.yaml). For example:

pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml

Validate that the file referenced by "pod-security-admission-config-file" exists and the default configuration settings match the following:

defaults:
audit: restricted
audit-version: latest
enforce: restricted
enforce-version: latest
warn: restricted
warn-version: latest

If "pod-security-admission-config-file" is not set, the file does not exist, or the configuration file differs from the above, this is a finding.

Vulnerability Number

V-254571

Documentable

False

Rule Version

CNTR-R2-001130

Severity Override Guidance

On each controlplane node, retrieve the "pod-security-admission-config-file" value from the RKE2 config file (/etc/rancher/rke2/config.yaml). For example:

pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml

Validate that the file referenced by "pod-security-admission-config-file" exists and the default configuration settings match the following:

defaults:
audit: restricted
audit-version: latest
enforce: restricted
enforce-version: latest
warn: restricted
warn-version: latest

If "pod-security-admission-config-file" is not set, the file does not exist, or the configuration file differs from the above, this is a finding.

Check Content Reference

M

Target Key

5486