Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

No.Project NameTSC Subgroup Release StatusIs this your first release 

Blue Print Stage

  • Self-Certify
  • Incubation
  • Mature
  • Core

CD Logs URL to be used for review

(Column filled in by PTLs)

How to: Push Logs to Nexus

Jenkins Master for Private Lab

Jenkins Peering Guide

Example: 

KubeEdge BP Test Documents

Link to executive one pager

(editable doc format)

(Column filled in by PTLs)

API Info Reporting Review

(Column filled in by API Subcommittee)

(note for PTLs – go here for steps to fill in project API info form)

BluVal

Certification

Bluval User Guide

Security

Certification

Provide link to Vuls, Lynis, and Kube-Hunter logs below.

Pass/Fail Criteria:  Steps To Implement Security Scan Requirements

Exception requests should be filed at:

Release 5: Akraino CVE Vulnerability Exception Request

Upstream Review (Column filled by Upstream Subcommittee and PTLs)


(note PTL can go to Release 5 BP/Feature Upstream Status to find details)

Date ready for TSC review

(Column filled in by PTLs)

 TSC Review Date

(Column filled in by TSC)


1
NoMaturehttps://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/cvb/CVB_Akraino_R5_blueprint_Datasheet.docxPer e-mail from WANG Tao (Tucker Wang) 20Aug21, no changes from R4

Completed by 8/24/2021


2

Maturehttps://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/iec-type4/Per e-mail from Bart 7Sep21, no changes from R4





3














4
NoIncubation

ICN Master Bare Metal Deployment Verifier

ICN Master Virtual Deployment Verifier

ICN R5 DatasheetPer notice from Kural 5Aug21, no change from R4

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/os/lynis/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/os/vuls/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/k8s/kube-hunter/

Filed Release 5: Akraino CVE Vulnerability Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted 

Completed by 8/6/2021


5
YesIncubationhttps://nexus.akraino.org/content/sites/logs/intel/ICN_CD_logs/pod11-node5/icn-master-bm-verify-bm_verifer-kata/12/ICN-MTSCN R5 Datasheet

API form uploaded 24 May

e-mail questions exchanged 20Jul21

Scheduled for review by API subcommittee  

API subcommittee review completed and info accepted  

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/os/lynis/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210712-025145/results/os/vuls/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/k8s/kube-hunter/

Filed Release 5: Akraino CVE Vulnerability Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted 

Completed by 8/10/2021


6
NoIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/eliot-build/18/home/jenkins/log/Per e-mail from Khemendra 26Aug21, no changes from R4

https://nexus.akraino.org/content/sites/logs/huawei/job/eliot-security-validation-build/4/results/


Akraino BluVal Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed 8/6/2021


7
NOIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/eliot-uCPE-build/15/home/jenkins/log/ELIOT R5 - SD-WAN / WAN Edge / uCPE Data SheetPer e-mail from Khemendra 26Aug21, no changes from R4

https://nexus.akraino.org/content/sites/logs/huawei/job/eliot-uCPE-security-build/10/results/


Akraino BluVal Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed on 8/6/2021


8
No

https://nexus.akraino.org/content/sites/logs/juniper/validation-2021/

Blueprint Data SheetPer e-mail from Sukhdev 5Aug21, no change from R4Not required as there is no change from Release 4
Completed by 8/10/2021


9
NoIncubationhttps://jenkins.akraino.org/job/kni-blueprint-pae-verify-deploy-gcp/69/

Per e-mail from Ricardo 10Aug21, he uploaded R5 API info forms for both KNI blueprints, with no substantive changes from R4. The API subcommittee has a review scheduled for of the new API info forms and will update this table afterwards

On the API Subcommittee reviewed and accepted the R5 API form


https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results/

Incubation Level Review Results:

Vuls:  Need to provide vul.log output file

__________________________________________________________

LynisAccepted 

____________________________________________________________

Output manually generated, located at:

Release 5 Security Scan Manual Logs

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed by 8/10/20219/16/2021

10
NoIncubation

Management Hub:

https://logs.akraino.org/production/vex-yul-akraino-jenkins-prod-1/kni-blueprint-management-hub-verify-deploy-gcp/19/

Industrial Edge:

https://logs.akraino.org/production/vex-yul-akraino-jenkins-prod-1/kni-blueprint-ie-verify-deploy-gcp/4/

See above note


https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results/

Incubation Level Review Results:

Vuls:  Need to provide vul.log output file

__________________________________________________________

LynisAccepted 

____________________________________________________________

Output manually generated, located at:

Release 5 Security Scan Manual Logs

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed by 8/10/20219/16/2021

11

Micro-MEC

Ferenc Székely







 







12











13
No
  • Incubation
https://nexus.akraino.org/content/sites/logs/fate/job/I-VICS/5/Intelligent Vehicle-Infrastructure Cooperation System(I-VICS) Datasheet

Per e-mail from Zhuming Zhang (Simmy Zhang) 30Aug21, no changes from R4

Confirmed by Sihui Wang in e-mail 30Aug21

https://nexus.akraino.org/content/sites/logs/fate/job/I-VICS/5/No new features or bugs have been added after R4 releaseMissing Upstream information


14

TSC 2021-08-17 (Tuesday) 7:00 am Pacific

No
https://nexus.akraino.org/content/sites/logs/tencent/job/tencent_5g_mec/Per e-mail from Eagan Fu 15Aug21, no change from R4

Completed by 8/24/2021


15











16
NoIncubationhttps://nexus.akraino.org/content/sites/logs/cmti/job/iec5_r4/15/IEC Release4-SmartNIC datasheet.docxPer e-mail from Leo 11Aug21, no change from R4

Bluval Exception has been accepted for the project.

Akraino BluVal Exception Request


R5 Release Notes of IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family


Completed by 8/30/2021




17
NoIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/ealt-edge-build/51/home/jenkins/log/EALTEDGE Release 5 DatasheetPer e-mail from Khemendra 20Aug21 (with Gaurav cc'd), no changes from R4

https://nexus.akraino.org/content/sites/logs/huawei/job/ealt-security-validation-build/19/results/


Akraino BluVal Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

R5 - Architecture Documentation of Enterprise Applications on Lightweight 5G Telco Edge


Completed by 8/10/2021




18TSC 2021-08-10 (Tuesday) 7:00 am PacificNo
https://nexus.akraino.org/content/sites/logs/cmti/job/pcei-daily/https://wiki.akraino.org/x/lwHkAg

Per API Subcommittee meeting 30Jul21, no change from R4

PCEI R5 API Doc:

https://wiki.akraino.org/x/qgHkAg

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

Lynis:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

PCEI R5 Release Notes

https://wiki.akraino.org/x/LgLkAg



Completed by 8/6/2021

 



19
No
  • Incubation
https://nexus.akraino.org/content/sites/logs/fate/job/Fate_test/15/Akraino R5 Federated ML blueprint datasheet.docxPer e-mail from Zifan 8Aug21, no change from R4

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

__________________________________________________________

LynisAccepted

__________________________________________________________

Kube-Hunter:  Exception granted:  K8s not used by this BP.

federated ML

Release Notes

R5 Federated ML application at edge Release Notes


Completed by 8/30/2021




20











21

TSC 2021-08-03 (Tuesday) 7:00 am Pacific

NoIncubationhttps://nexus.akraino.org/content/sites/logs/juniper/job/Private%205G%20BP/Akraino Private LTE/5G BP DatasheetPer e-mail from Prem 27Aug21, no change from R4

Completed by 8/10/2021


22











23
Yes
https://nexus.akraino.org/content/sites/logs/myais/job/parsec/10/
https://nexus.akraino.org/content/sites/logs/myais/validation/1/




24

MEC-based Stable Topology Prediction for Vehicular Networks

Asif Mehmood


Yes








25
NoIncubationhttps://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/cdlogs/

Ashvin Kumar uploaded API info form. API subcommittee review scheduled for

(Note - the form was originally uploaded 27Aug21 but had a file corruption issue)

Review completed and info accepted

https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/conformance/


https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/kube-hunter/

 

Vuls: Need to provide vuls.log output file

__________________________________________________________

LynisNeed to provide lynis.log output file

__________________________________________________________

Kube-Hunter: 

  Cluster: The following vulnerabilities must be fixed:

  • KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.
  • KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged: false policy.

  Pod:  The following vulnerabilities must be fixed:

  • Access to pod's secrets

    Suggestion: 

    https://blog.aquasec.com/managing-kubernetes-secrets

    Securing etcdsecret data is stored in etcd. By default, etcd data is not encrypted and neither are your secrets. You should enable encryption at rest, limit access to etcd to admin users only, and safely dispose of disks where etcd data was formerly stored

    Use SSL/TLSwhen running etcd in a cluster, you must use secure peer-to-peer communication.

  • Exposed PodsDescription:  An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint.
  • KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

  • KHV007 - Specific Access to Kubernetes API Suggestion:  Review the RBAC permissions to Kubernetes API server for the anonymous and default service account

  • KHV005 - Access to Kubernetes API

  • KHV002 - Kubernetes version disclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

  • KHV050 - Read access to Pod service account token

    Suggestion:  It is recommended to explicitly specify a Service Account for all of your workloads (serviceAccountName in Pod.Spec), and manage their permissions according to the least privilege principle.

    Consider opting out automatic mounting of SA token using automountServiceAccountToken: false on ServiceAccount resource or Pod.spec.

  • KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged:  false policy.

Missing Upstream information in IEC Type 2 Release Notes for R5


26
No









27

Federated Multi-Access Edge Cloud Platform

Deepak Vij


Yes









...