Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status.
Description
Discussion Text
Controlling access to those users and roles responsible for patching and updating RKE2 reduces the risk of untested or potentially malicious software from being installed within the platform. This access may be separate from the access required to install container images into the registry and those access requirements required to instantiate an image into a service. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.
Kubernetes uses the API Server to control communication to the other services that makeup Kubernetes. The use of authorizations and not the default of "AlwaysAllow" enables the Kubernetes functions control to only the groups that need them.
To control access, the API server must have one of the following options set for the authorization mode:
--authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode allows a user to configure policies using local files.
--authorization-mode=RBAC Role-based access control (RBAC) mode allows a user to create and store policies using the Kubernetes API.
--authorization-mode=Webhook
WebHook is an HTTP callback mode that allows a user to manage authorization using a remote REST endpoint.
--authorization-mode=Node
Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.
--authorization-mode=AlwaysDeny
This flag blocks all requests. Use this flag only for testing.
Satisfies: SRG-APP-000378-CTR-000880, SRG-APP-000378-CTR-000885
Kubernetes uses the API Server to control communication to the other services that makeup Kubernetes. The use of authorizations and not the default of "AlwaysAllow" enables the Kubernetes functions control to only the groups that need them.
To control access, the API server must have one of the following options set for the authorization mode:
--authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode allows a user to configure policies using local files.
--authorization-mode=RBAC Role-based access control (RBAC) mode allows a user to create and store policies using the Kubernetes API.
--authorization-mode=Webhook
WebHook is an HTTP callback mode that allows a user to manage authorization using a remote REST endpoint.
--authorization-mode=Node
Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.
--authorization-mode=AlwaysDeny
This flag blocks all requests. Use this flag only for testing.
Satisfies: SRG-APP-000378-CTR-000880, SRG-APP-000378-CTR-000885
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.