Security Certifications
& Verifications

SUSE adheres to best practice and industry standards when it comes to security and certifications including NIST, Common Criteria, DISA, and more.

DISA STIG Guides

Rancher Government Services are currently in the process of developing Rancher and RKE2 STIGs with DISA. We allow our customers to access these in-flight for further reference and encourage any feedback you may have. These STIG documents are not in the official draft state with DISA yet; they are in the development stages.

Rancher Draft DISA STIG
https://rfed-public.s3-us-gov-east-1.amazonaws.com/RGS-STIG-Drafts/RancherMCM_V1_091221.xlsm

RKE2 Draft DISA STIG
https://rfed-public.s3-us-gov-east-1.amazonaws.com/RGS-STIG-Drafts/RKE2_800-53_STIG.xlsx

The following STIG documents address many generic configurations that any Kubernetes cluster should follow. RKE2 is very secure by default so a large portion of these is already built into RKE2, and the remaining can be either configured in a very declarative fashion or mitigated by other certified Rancher integrations. Note that both of these documents assume generic Kubernetes clusters so things like file paths may not be 1:1 to how RKE2 does things but they can still help with security by providing even more evidence of a secure cluster.

Kubernetes Draft STIG – Ver 1, Rel 1:
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V1R1_STIG.zip

This is the generic platform STIG and can also be used as a generic reference to ensure you’re covering all controls.

Container Platform SRG – Ver 1, Rel 1
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Container_Platform_V1R1_SRG.zip

CIS Benchmarks

The Center for Internet Security (CIS – https://www.cisecurity.org/benchmark/kubernetes/) is an accepted third-party and nonprofit organization whose mission is to “identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace” (https://www.cisecurity.org/about-us/). RGS takes these benchmarks and either builds the controls directly into RKE2 or allows for the configuration to be applied extremely easily via automated scripts and input parameters. In addition to applying the benchmarks, we also build tools that can periodically scan security configurations to enforce this compliance.

Enumerating the controls contained in these documents can also provide a large body of evidence needed for security approvals.

Consult the following resources for information about hardening your cluster according to the CIS benchmarks:

USAF IronBank

Rancher Government Services (RGS) works closely with SUSE Labs to ensure images are secure and up to government standards wherever possible. RGS also develops and maintains pipelines with Platform One’s Iron Bank to provide hardened versions of images available to all teams with access to Iron Bank.

RKE2 Source Code @ Repo1

Iron Bank images require the following functions:

  • CVE vulnerability feedback
    • RGS and SUSE Labs both independently scan images and work together to mitigate findings
    • SUSE Labs has automated processes for scanning images before they are pushed and creating mitigation tasks internally for engineers to fix findings
  • Image rebuilds
    • In addition to ensuring images in docker.io/rancher are secure, RGS works with the Platform One team to rebuild images for pushing into the Iron Bank repositories
    • SUSE Labs-backed image rebuild process ensuring SUSE Labs supported end results
    • Re-scanned with Iron Bank scanners
      • Twistlock, Trivy, Anchore CVE + Compliance
    • Uses Iron Bank certified base images for more security.
Learn More about SUSE Security <br /> Certifications

Learn More about SUSE Security
Certifications

View the SUSE Product and Certification Standards