What changed in Rancher Government Solutions RKE2 STIG V2R7V2R7 changes

Fix text

Disable unnecessary RKE2 components. Edit the RKE2 Server configuration file on all RKE2 Server hosts, located at /etc/rancher/rke2/config.yaml, so that it contains a "disable" flag if any default RKE2 components are unnecessary. Example: disable: - rke2-canal disable: rke2-coredns disable: rke2-ingress-nginx disable:- rke2-kube-proxy disable:- rke2-metrics-server - rke2-coredns Once the configuration file is updated, restart the RKE2 Server. Run the command: systemctl restart rke2-server

Discussion

It is important to disable any unnecessary components to reduce any potential attack surfaces. RKE2 allows disabling the following components: - rke2-canal - rke2-coredns - rke2-ingress-nginx - rke2-kube-proxy - rke2-metrics-server If utilizingusing any of these components presents a security risk, or if any of the components are not required then they can be disabled by using the "disable" flag. If any of the components are not required, they can be disabled by using the "disable" flag. Satisfies: SRG-APP-000141-CTR-000315, SRG-APP-000384-CTR-000915

V-254565 in V2R7

Check text

Ensure authorization-mode is set correctly in the apiserver. Run this command on all RKE2 Control Plane hosts: /bin/ps -ef | grep kube-apiserver | grep -v grep If --authorization-mode is not set to "RBAC,Node" or is not configured, this is a finding. (By default, RKE2 sets Node,RBAC as the parameter to the --authorization-mode argument.)

Fix text

Edit the RKE2 Server configuration file on all RKE2 Control Plane hosts, located at /etc/rancher/rke2/config.yaml, to contain the following: kube-apiserver-arg: --authorization-mode=RBAC,Node Once the configuration file is updated, restart the RKE2 Server. Run the command: systemctl restart rke2-server

Discussion

Controlling access to those users and roles responsible for patching and updating RKE2 reduces the risk of untested or potentially malicious software from being installed within the platform. This access may be separate from the access required to install container images into the registry and those access requirements required to instantiate an image into a service. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user. Kubernetes uses the API Server to control communication to the other services that makeupmake up Kubernetes. The use of authorizations and not the default of "AlwaysAllow" enables the Kubernetes functions control to only the groups that need them. To control access, the API server mustcan havebe oneconfigured ofwith the following optionsflags set for the authorization -mode: (Note: For this STIG, the setting must be "RBAC" or "Node".) --authorization-mode=ABAC (Attribute-Based Access Control ([ABAC)] mode allows a user to configure policies using local files.) --authorization-mode=RBAC (Role-based access control ([RBAC)] mode allows a user to create and store policies using the Kubernetes API.) --authorization-mode=Webhook (WebHook is an HTTP callback mode that allows a user to manage authorization using a remote REST endpoint.) --authorization-mode=Node (Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.) --authorization-mode=AlwaysDeny (This flag blocks all requests. Use this flag only for testing.) Satisfies: SRG-APP-000378-CTR-000880, SRG-APP-000378-CTR-000885

V-254572 in V2R7