STIGQter STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Rancher RKE2 must remove old components after updated versions have been installed.

DISA Rule

SV-254574r961677_rule

Vulnerability Number

V-254574

Group Title

SRG-APP-000454-CTR-001110

Rule Version

CNTR-R2-001580

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Remove any old pods that are using older images. On the RKE2 Control Plane, run the command:

kubectl delete pod podname
(Note: "podname" is the name of the pod to delete.)

Run the command:
systemctl restart rke2-server

Check Contents

To view all pods and the images used to create the pods, from the RKE2 Control Plane, run the following command:

kubectl get pods --all-namespaces -o jsonpath="{..image}" | \
tr -s '[[:space:]]' '\n' | \
sort | \
uniq -c

Review the images used for pods running within Kubernetes.
If there are multiple versions of the same image, this is a finding.

Vulnerability Number

V-254574

Documentable

False

Rule Version

CNTR-R2-001580

Severity Override Guidance

To view all pods and the images used to create the pods, from the RKE2 Control Plane, run the following command:

kubectl get pods --all-namespaces -o jsonpath="{..image}" | \
tr -s '[[:space:]]' '\n' | \
sort | \
uniq -c

Review the images used for pods running within Kubernetes.
If there are multiple versions of the same image, this is a finding.

Check Content Reference

M

Target Key

5486