STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status.

DISA Rule

SV-254572r1208192_rule

Vulnerability Number

V-254572

Group Title

SRG-APP-000378-CTR-000880

Rule Version

CNTR-R2-001270

Severity

CAT II

CCI(s)

• CCI-003980 - Allow user installation of software only with explicit privileged status.

Weight

10

Fix Recommendation

Edit the RKE2 Server configuration file on all RKE2 Control Plane hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:

kube-apiserver-arg:
--authorization-mode=RBAC,Node

Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server

Check Contents

Ensure authorization-mode is set correctly in the apiserver.

Run this command on all RKE2 Control Plane hosts:
/bin/ps -ef | grep kube-apiserver | grep -v grep

If --authorization-mode is not set to "RBAC,Node" or is not configured, this is a finding.
(By default, RKE2 sets Node,RBAC as the parameter to the --authorization-mode argument.)

Vulnerability Number

V-254572

Documentable

False

Rule Version

CNTR-R2-001270

Severity Override Guidance

Ensure authorization-mode is set correctly in the apiserver.

Run this command on all RKE2 Control Plane hosts:
/bin/ps -ef | grep kube-apiserver | grep -v grep

If --authorization-mode is not set to "RBAC,Node" or is not configured, this is a finding.
(By default, RKE2 sets Node,RBAC as the parameter to the --authorization-mode argument.)

Check Content Reference

M

Target Key

5486