Detections
Analytics

CNTR-R2-001130 - Rancher RKE2 must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Admission controllers intercept requests to the Kubernetes API before an object is instantiated. Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated or deleted.

Admissions controllers can be used for:
- Prevent pod's ability to run privileged containers
- Prevent pod's ability to use privileged escalation
- Controlling pod's access to volume types
- Controlling pod's access to host file system
- Controlling pod's usage of host networking objects and configuration

Satisfies: SRG-APP-000340-CTR-000770, SRG-APP-000342-CTR-000775

Solution

On each Control Plane node, create the file "/etc/rancher/rke2/rke2-pss-custom.yaml" and add the following content:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
 configuration:
 apiVersion: pod-security.admission.config.k8s.io/v1beta1
 kind: PodSecurityConfiguration
 defaults:
 enforce: "restricted"
 enforce-version: "latest"
 audit: "restricted"
 audit-version: "latest"
 warn: "restricted"
 warn-version: "latest"
 exemptions:
 usernames: []
 runtimeClasses: []
 namespaces: [kube-system, cis-operator-system, tigera-operator]

Verify the namespace exemptions contain only namespaces requiring access to capabilities outside of the restricted settings above.

Once the file is created, add the following to the RKE2 config file (/etc/rancher/rke2/config.yaml):

pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml

Once the "pod-security-admission-config-file" has been added, restart the Control Plane nodes with:

systemctl restart rke2-server

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RGS_RKE2_V2R5_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002233, CCI|CCI-002235, Rule-ID|SV-254571r1156616_rule, STIG-ID|CNTR-R2-001130, Vuln-ID|V-254571

Plugin: Unix

Control ID: 2141fd50dba393caa136d366e812214eddfd0d071a26492ff1b3992832e0da8d