STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 3 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to Rancher Government Solutions RKE2 Security Technical Implementation Guide

V-254567

CAT II (Medium)

Rancher RKE2 must store only cryptographic representations of passwords.

Rule ID

SV-254567r1016559_rule

STIG

Rancher Government Solutions RKE2 Security Technical Implementation Guide

Version

V2R6

CCIs

CCI-004062CCI-000196

Discussion

Secrets, such as passwords, keys, tokens, and certificates should not be stored as environment variables. These environment variables are accessible inside RKE2 by the "Get Pod" API call, and by any system, such as CI/CD pipeline, which has access to the definition file of the container. Secrets must be mounted from files or stored within password vaults.

Check Content

On the RKE2 Control Plane, run the following commands:

kubectl get pods -A
kubectl get jobs -A
kubectl get cronjobs -A

This will output all running pods, jobs, and cronjobs. 

Evaluate each of the above commands using the respective commands below:

kubectl get pod -n <namespace> <pod> -o yaml
kubectl get job -n <namespace> <job> -o yaml
kubectl get cronjob -n <namespace> <cronjob> -o yaml

If any contain sensitive values as environment variables, this is a finding.

Fix Text

Any secrets stored as environment variables must be moved to the secret files with the proper protections and enforcements or placed within a password vault.