What changed in Rancher Government Solutions Multi-Cluster Manager STIG V2R2V2R2 changes

Rancher Government Solutions Multi-Cluster Manager STIG V2R2 (2026-01-05) replaced V2R1 (2024-07-24): 2 checks updated. It has 7 checks, against 7 in V2R1.

V2R2 checklistV2R1 checklist Compare V2R1 and V2R2 in STIG Compare

  • 0 added
  • 0 removed
  • 2 updated

Updated fields: CCIs 1Check text 1Discussion 1

Updated in V2R2 (2)

V-252843CAT IRancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.CCIs

CCIs

CCI-000015,CCI-000016,CCI-000044,CCI-000134,CCI-000154,CCI-000162,CCI-000163,CCI-000164,CCI-000187,CCI-004066,CCI-004062,CCI-000197,CCI-004061,CCI-000206,CCI-000213,CCI-000764,CCI-000765,CCI-000766,CCI-003627,CCI-001090,CCI-001350,CCI-001368,CCI-001403,CCI-001493,CCI-001494,CCI-001495,CCI-001499,CCI-001764,CCI-003980,CCI-001813,CCI-003938,CCI-001941,CCI-004045,CCI-002235,CCI-002238,CCI-000192,CCI-000193,CCI-000194,CCI-000195,CCI-000196,CCI-000198,CCI-000199,CCI-000205,CCI-000795,CCI-001619,CCI-001812,CCI-001814,CCI-002142

V-252843 in V2R2

V-252849CAT IRancher MCM must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithms for transmission.Check text, Discussion

Check text

Navigate to Triple Bar Symbol(Global) >> &ltlocal cluster>. From the kubectl shell (>_), execute: kubectl get ingress -n cattle-system rancher -o yaml Verify the port number for Rancher is using "443", like the following: spec: rules: - host: rancher.rfed.us http: paths: - backend: service: name: rancher port: number: 443 From the kubectl shell (>_), execute: kubectl get networkpolicies -n cattle-system Verify networkpolicies exist and that they are only allowing traffic to port "444" of the Rancher pods, like the following: NAME POD-SELECTOR AGE rancher-allow-https app=rancher 10h rancher-deny-ingress app=rancher 10h If the ingress output is not using port 443, or there are not network policies in place to only allow traffic to port 444, this is a finding.

Discussion

The containerRancher platformapplication and its components will adhere to NIST 800-52R2. To ensure that traffic coming through the ingress controller is re-encrypted internally, switch off port 80 on the service object and direct ingress traffic to port 443 over HTTPS.

V-252849 in V2R2

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.