Detections
Analytics

CNTR-R2-000940 - Rancher RKE2 runtime must isolate security functions from nonsecurity functions.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

RKE2 runs as isolated as possible.

RKE2 is a container-based Kubernetes distribution. A container image is essentially a complete and executable version of an application, which relies only on the host's OS kernel. Running containers use resource isolation features in the OS kernel, such as cgroups in Linux, to run multiple independent containers on the same OS. Unless part of the core RKE2 system or configured explicitly, containers managed by RKE2 should not have access to host resources.

Proper hardening of the surrounding environment is independent of RKE2 but ensures overall security stature.

When Kubernetes launches a container, there are several mechanisms available to ensure complete deployments:
- When a primary container process fails it is destroyed rebooted.
- When Liveness checks fail for the container deployment it is destroyed rebooted.
- If a readiness check fails at any point after the deployment the container is destroyed rebooted.
- Kubernetes has the ability to rollback a deployment configuration to a previous state if a deployment fails.
- Failover traffic to a working replica if any of the previous problems are encountered.

System kernel is responsible for memory, disk, and task management. The kernel provides a gateway between the system hardware and software. Kubernetes requires kernel access to allocate resources to the Control Plane. Threat actors that penetrate the system kernel can inject malicious code or hijack the Kubernetes architecture. It is vital to implement protections through Kubernetes components to reduce the attack surface.

Solution

Edit the RKE2 configuration file on all RKE2 hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:

kubelet-arg: --protect-kernel-defaults=true

If configuration files are updated on a host, restart the RKE2 service using the command "systemctl restart rke2-server" for server hosts and "systemctl restart rke2-agent" for agent hosts.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RGS_RKE2_V2R6_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-3, CAT|II, CCI|CCI-001084, Rule-ID|SV-254569r1188307_rule, STIG-ID|CNTR-R2-000940, Vuln-ID|V-254569

Plugin: Unix

Control ID: a0d3a990c9a1f6c48685d83c2aab24eabaa65599f4f26e51697d8573cb541186