Rancher Government Solutions RKE2 STIG Version Comparison

There are 4 differences between versions v2 r2 (Oct. 24, 2024) (the "left" version) and v2 r4 (Oct. 1, 2025) (the "right" version).

Check CNTR-R2-000120 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

The Kubernetes API server must have the insecure port flag disabled.

Check Content

Ensure Verify insecure-port is set correctly. If running v1.20 through v1.23, this is default configuration so no change is necessary if not configured. If configured. If running v1.24, v1.24 or higher, this check is Not Applicable. Run this command on the RKE2 Control Plane: /bin/ps -ef | grep kube-apiserver | grep -v grep If --insecure-port is not set to "0" or is not configured, this is a finding.

Discussion

By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also called the "insecure port", port 8080. Any requests to this port bypass authentication and authorization checks. If this port is left open, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place, and have full control over the entire cluster. Close the insecure port by setting the API server's --insecure-port flag to "0", ensuring that the --insecure-bind-address is not set.

Fix

Edit If running v1.20 through v1.23, this is the default configuration, so no change is necessary if not configured. If running v1.24 or higher, this check is Not Applicable. Edit the RKE2 Server configuration file on all RKE2 Server hosts, located at /etc/rancher/rke2/config.yaml, to contain the following: kube-apiserver-arg: - insecure-port=0 Once the configuration file is updated, restart the RKE2 Server. Run the following command: systemctl restart rke2-server