skills.rest
dydx
dydxCOMMUNITY
Explore all skills by this author →
GitHub

rke2-security-hardening

Configure CIS hardening, secrets encryption, certificates, and FIPS compliance for RKE2 clusters.

2|Updated Jul 22, 2026
Search Tags:#kubernetes#security hardening#cis benchmark#fips#secrets encryption#rke2#certificate rotation
One-click install
npx skills add https://github.com/dydx/rke2-skills --skill rke2-security-hardening-dydx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rke2-security-hardening
Source: https://github.com/dydx/rke2-skills/tree/main/skills/rke2-security-hardening
Command: npx skills add https://github.com/dydx/rke2-skills --skill rke2-security-hardening-dydx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Securing a self-hosted RKE2 cluster beyond its hardened defaults requires navigating CIS benchmark profiles, Pod Security Admission, secrets encryption key rotation, SELinux policies, certificate lifecycles, join tokens, and FIPS 140-2 constraints, each with version-specific procedures and manual host-level steps that are easy to miss. ## Core Features & Use Cases - CIS Benchmark Hardening: Enable profile: cis, satisfy host prerequisites (etcd user, sysctl kernel parameters), patch default ServiceAccounts, and configure audit policies and NetworkPolicies. - Secrets Encryption & Key Rotation: Manage at-rest encryption providers (aescbc vs secretbox) and execute modern or classic rke2 secrets-encrypt rotation procedures for single-server and HA clusters. - Certificate & Token Lifecycle: Check and rotate leaf certificates, rotate 10-year CA certificates with rotate-ca, provision custom CAs, and rotate server/agent/bootstrap tokens. - Use Case: A platform engineer preparing an RKE2 v1.30 cluster for a compliance audit uses this Skill to enable CIS mode, apply the sysctl config, set a real audit policy, rotate encryption keys across three HA servers, and verify FIPS-compliant component selection. ## Quick Start Ask how to enable CIS hardening on a new RKE2 cluster, including the etcd user setup, sysctl configuration, and the config.yaml profile setting.

Frequently Asked Questions about rke2-security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable CIS hardening on an RKE2 cluster?▼

Set profile: "cis" in /etc/rancher/rke2/config.yaml before first start, after creating the etcd user with useradd and applying rke2-cis-sysctl.conf to /etc/sysctl.d. RKE2 then validates host requirements, applies NetworkPolicies, and enforces restricted Pod Security Admission.

How do I rotate secrets encryption keys in RKE2?▼

Run rke2 secrets-encrypt rotate-keys on one server, then wait for rke2 secrets-encrypt status to show reencrypt_finished. On HA clusters, sequentially restart rke2-server on each server afterward, and always take an etcd snapshot before rotating.

Does RKE2 support SELinux in enforcing mode?▼

Yes, RKE2 supports SELinux-enforcing hosts via the rke2-selinux policy package, which adds rke2_service_db_t and rke2_service_t contexts. RPM installs enable it by default; tarball installs require selinux: true in config.yaml.

How do I rotate RKE2 CA certificates before they expire?▼

Stage new CA material in a separate temporary directory and run rke2 certificate rotate-ca --path=<dir>, then restart RKE2 on all nodes, servers first. Self-signed CAs are valid 10 years and are not auto-renewed, unlike leaf certs which renew on restart within 120 days of expiry.

Is RKE2 secrets encryption FIPS 140-2 compliant?▼

Only the default aescbc provider is FIPS 140-2 compliant; the secretbox provider is not. FIPS builds use the Go BoringCrypto toolchain, and only the Canal CNI and Linux AMD64 architecture are covered by the FIPS-compiled component list.

What happened to PodSecurityPolicies in RKE2 v1.25?▼

PodSecurityPolicies were removed in Kubernetes v1.25 and replaced by Pod Security Admission. RKE2 writes a PSA configuration to /etc/rancher/rke2/rke2-pss.yaml, enforcing restricted mode cluster-wide when the CIS profile is set, with exemptions for kube-system and operator namespaces.

Related Skills

Explore More Software Engineering Skills→
masermediagroup-stackmasermediagroup-stack
1

security-hardening

Harden OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust controls.

Community
Advanced
xalgordxalgord
954

performing-kubernetes-cis-benchmark-with-kube-bench

Audit Kubernetes clusters against CIS benchmarks using kube-bench checks.

Community
Intermediate
kcns008kcns008
5

security

Audit Kubernetes and OpenShift clusters for RBAC, NetworkPolicy, pod security, and compliance gaps.

Community
Advanced
TheMacroeconomicDaoTheMacroeconomicDao

infra_sentinel

Audit Kubernetes security posture for the openclaw namespace on K3s.

Community
Advanced