Rancher RKE2 keystore must implement encryption to prevent unauthorized disclosure of information at rest within Rancher RKE2.

STIG ID: CNTR-R2-001500  |  SRG: SRG-APP-000429-CTR-001060 |  Severity: high |  CCI: CCI-002476 |  Vulnerability Id: V-254573

Vulnerability Discussion

Encrypting secrets at rest in etcd.

By default, RKE2 will create an encryption key and configuration file and pass these to the Kubernetes API server. The result is that RKE2 automatically encrypts Kubernetes Secret objects when writing them to etcd.

Check

This is Not Applicable for RKE2 versions 1.20 and greater.

Review the encryption configuration file.

As root or with root permissions, run the following command:
view /var/lib/rancher/rke2/server/cred/encryption-config.json

Ensure the RKE2 configuration file on all RKE2 servers, located at /etc/rancher/rke2/config.yaml, does NOT contain:

secrets-encryption: false

If secrets encryption is turned off, this is a finding.

Fix

This is Not Applicable for RKE2 versions 1.20 and greater.

Enable secrets encryption.

Edit the RKE2 configuration file on all RKE2 servers, located at /etc/rancher/rke2/config.yaml, so that it contains:

secrets-encryption: true
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.