https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# rke2
a
This message was deleted.
c
the controller-manager only has one listener, it’s only used for metrics, and we bind it to localhost. It doesn’t really accept connections from anything, and there’s no confidential information in it
That sounds like someone copy-pasted some text from the apiserver configuration?
s
for the DISA STIG?
it’s part of their recent k8s release
c
interesting
Our hardening guides are all based on the CIS benchmarks
s
Any interest in working to help make RKE2 comply w/ DISA STIGs as well (required for DoD)
c
If it wants extra args set, you can use --kube-apiserver-arg, --kube-controller-manager-arg etc to set those
s
like if I can provide information during my analysis?
c
so --kube-controller-manager-arg=tls-min-version=VersionTLS12
s
ha awesome yah that’s what I was just typing out
ok perfect ty!
c
The RGS guys may have done some work on that already as they are more in tune with the STIG stuff I believe
s
want me to make a list of things that need to be done to help RKE2 comply w/ DISA STIGs? any interest in community?
c
s
nice… ok thanks!
c
RGS / Rancher Federal handle all of our government contracts so they’re the ones that focus on that sort of stuff
s
got it ok, yah I figured RKE2 seems like it’s geared more towards Federal and esp DoD since it’s difficult to comply with their reqs
✅ 1
c
I’m not sure how many of them are on this slack but I could probably ask internally if you run into any roadblocks
👍 1
s
Thanks and I’ll work on a gist of notes of where I may see deltas or run into issues
j
I have worked on the Rancher STIGs with the RGS folks and work with them somewhat frequently. Feel free to ping me if you need anything
s
@jolly-ocean-26422 will do thank you!
@creamy-pencil-82913 is it possible to specify the 
kube-controller-manager-arg
arg within the 
/etc/rancher/rke2/config.yaml
file?
something like this:
Copy code
kube-controller-manager-arg:
            - tls-min-version=VersionTLS12
yes that seems to have worked! 🙂
9 Views
Open in Slack
PreviousNext
Powered by