Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

No.Project NameTSC Subgroup Release StatusIs this your first release 

Blue Print Stage

  • Self-Certify
  • Incubation
  • Mature
  • Core

CD Logs URL to be used for review

(Column filled in by PTLs)

How to: Push Logs to Nexus

Jenkins Master for Private Lab

Jenkins Peering Guide

Example: 

KubeEdge BP Test Documents

Link to executive one pager

(editable doc format)

(Column filled in by PTLs)

API Info Reporting Review

(Column filled in by API Subcommittee)

(note for PTLs – go here for steps to fill in project API info form)

BluVal

Certification

Bluval User Guide

Security

Certification

Provide link to Vuls, Lynis, and Kube-Hunter logs below.

Pass/Fail Criteria:  Steps To Implement Security Scan Requirements

Exception requests should be filed at:

Release 5: Akraino CVE Vulnerability Exception Request

Upstream Review (Column filled by Upstream Subcommittee and PTLs)


(note PTL can go to Release 5 BP/Feature Upstream Status to find details)

Date ready for TSC review

(Column filled in by PTLs)

 TSC Review Date

(Column filled in by TSC)


1

Mature
CVB_Akraino_R5_blueprint_Datasheet.docxPer e-mail from WANG Tao (Tucker Wang) 20Aug21, no changes from R4

Completed by 8/24/2021


2

Mature








3














4
NoIncubation

ICN Master Bare Metal Deployment Verifier

ICN Master Virtual Deployment Verifier

ICN R5 DatasheetPer notice from Kural 5Aug21, no change from R4

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/os/lynis/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/os/vuls/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/k8s/kube-hunter/

Filed Release 5: Akraino CVE Vulnerability Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted 

Completed by 8/6/2021


5
YesIncubationhttps://nexus.akraino.org/content/sites/logs/intel/ICN_CD_logs/pod11-node5/icn-master-bm-verify-bm_verifer-kata/12/ICN-MTSCN R5 Datasheet

API form uploaded 24 May

e-mail questions exchanged 20Jul21

Scheduled for review by API subcommittee  

API subcommittee review completed and info accepted  

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/os/lynis/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210712-025145/results/os/vuls/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/k8s/kube-hunter/

Filed Release 5: Akraino CVE Vulnerability Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted 

Completed by 8/10/2021


6
NoIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/eliot-build/18/home/jenkins/log/Per e-mail from Khemendra 26Aug21, no changes from R4https://nexus.akraino.org/content/sites/logs/huawei/job/eliot-security-validation-build/4/results/

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed 8/6/2021


7
NOIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/eliot-uCPE-build/15/home/jenkins/log/
Per e-mail from Khemendra 26Aug21, no changes from R4https://nexus.akraino.org/content/sites/logs/huawei/job/eliot-uCPE-security-build/10/results/

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed on 8/6/2021


8
No

https://nexus.akraino.org/content/sites/logs/juniper/validation-2021/

Blueprint Data SheetPer e-mail from Sukhdev 5Aug21, no change from R4Not required as there is no change from Release 4
Completed by 8/10/2021


9
NoIncubationhttps://jenkins.akraino.org/job/kni-blueprint-pae-verify-deploy-gcp/69/

Per e-mail from Ricardo 10Aug21, he uploaded R5 API info forms for both KNI blueprints, with no substantive changes from R4. The API subcommittee has a review scheduled for of the new API info forms and will update this table afterwards


https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results/

Incubation Level Review Results:

Vuls:  Need to provide vul.log output file

__________________________________________________________

Lynis: FAILED

  • test ID AUTH-9328 (Default umask values)Suggestion: Default umask in /etc/login.defs could be more strict like 027
  • sysctl key kernel.dmesg_restrictSuggestion:  value should be set to '1'
  • sysctl key net.ipv4.conf.default.accept_source_routeSuggestion:  value should be set to '0'

____________________________________________________________

Output manually generated, located at:

Release 5 Security Scan Manual Logs

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed by 8/10/2021


10
NoIncubation

Management Hub:

https://logs.akraino.org/production/vex-yul-akraino-jenkins-prod-1/kni-blueprint-management-hub-verify-deploy-gcp/19/

Industrial Edge:

https://logs.akraino.org/production/vex-yul-akraino-jenkins-prod-1/kni-blueprint-ie-verify-deploy-gcp/4/

See above note


https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results/

Incubation Level Review Results:

Vuls:  Need to provide vul.log output file

__________________________________________________________

Lynis: FAILED

  • test ID AUTH-9328 (Default umask values)Suggestion: Default umask in /etc/login.defs could be more strict like 027
  • sysctl key kernel.dmesg_restrictSuggestion:  value should be set to '1'
  • sysctl key net.ipv4.conf.default.accept_source_routeSuggestion:  value should be set to '0'

____________________________________________________________

Output manually generated, located at:

Release 5 Security Scan Manual Logs

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed by 8/10/2021


11

Micro-MEC

Ferenc Székely






Ashwin Kumar uploaded API info form. API subcommittee review scheduled for  






12











13
No
  • Incubation
https://nexus.akraino.org/content/sites/logs/fate/job/I-VICS/5/Intelligent Vehicle-Infrastructure Cooperation System(I-VICS) Datasheet
https://nexus.akraino.org/content/sites/logs/fate/job/I-VICS/5/No new features or bugs have been added after R4 releaseMissing Upstream information


14

TSC 2021-08-17 (Tuesday) 7:00 am Pacific

No
https://nexus.akraino.org/content/sites/logs/tencent/job/tencent_5g_mec/Per e-mail from Eagan Fu 15Aug21, no change from R4

Completed by 8/24/2021


15











16
NoIncubationhttps://nexus.akraino.org/content/sites/logs/cmti/job/iec5_r4/15/IEC Release4-SmartNIC datasheet.docxPer e-mail from Leo 11Aug21, no change from R4

Bluval Exception has been accepted for the project.

Akraino BluVal Exception Request






17
NoIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/ealt-edge-build/51/home/jenkins/log/EALTEDGE Release 5 DatasheetPer e-mail from Khemendra 20Aug21, no changes from R4https://nexus.akraino.org/content/sites/logs/huawei/job/ealt-security-validation-build/19/results/

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

R5 - Architecture Documentation of Enterprise Applications on Lightweight 5G Telco Edge


Completed by 8/10/2021




18TSC 2021-08-10 (Tuesday) 7:00 am PacificNo
https://nexus.akraino.org/content/sites/logs/cmti/job/pcei-daily/https://wiki.akraino.org/x/lwHkAg

Per API Subcommittee meeting 30Jul21, no change from R4

PCEI R5 API Doc:

https://wiki.akraino.org/x/qgHkAg

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

Lynis:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

PCEI R5 Release Notes

https://wiki.akraino.org/x/LgLkAg



Completed by 8/6/2021

 



19
No
  • Incubation
https://nexus.akraino.org/content/sites/logs/fate/job/Fate_test/15/Akraino R5 Federated ML blueprint datasheet.docxPer e-mail from Zifan 8Aug21, no change from R4

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

__________________________________________________________

LynisAccepted

__________________________________________________________

Kube-Hunter:  Exception granted:  K8s not used by this BP.

federated ML

Release Notes

R5 Federated ML application at edge Release Notes




20











21

TSC 2021-08-03 (Tuesday) 7:00 am Pacific

NoIncubationhttps://nexus.akraino.org/content/sites/logs/juniper/job/Private%205G%20BP/Akraino Private LTE/5G BP Datasheet


Completed by 8/10/2021


22











23
Yes









24

MEC-based Stable Topology Prediction for Vehicular Networks

Asif Mehmood













25
NoIncubationhttps://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/cdlogs/

https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/conformance/


https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/kube-hunter/

 

Vuls: Need to provide vuls.log output file

__________________________________________________________

LynisNeed to provide lynis.log output file

__________________________________________________________

Kube-Hunter: 

  Cluster: The following vulnerabilities must be fixed:

  • KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.
  • KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged: false policy.

  Pod:  The following vulnerabilities must be fixed:

  • Access to pod's secrets

    Suggestion: 

    https://blog.aquasec.com/managing-kubernetes-secrets

    Securing etcdsecret data is stored in etcd. By default, etcd data is not encrypted and neither are your secrets. You should enable encryption at rest, limit access to etcd to admin users only, and safely dispose of disks where etcd data was formerly stored

    Use SSL/TLSwhen running etcd in a cluster, you must use secure peer-to-peer communication.

  • Exposed PodsDescription:  An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint.
  • KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

  • KHV007 - Specific Access to Kubernetes API Suggestion:  Review the RBAC permissions to Kubernetes API server for the anonymous and default service account

  • KHV005 - Access to Kubernetes API

  • KHV002 - Kubernetes version disclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

  • KHV050 - Read access to Pod service account token

    Suggestion:  It is recommended to explicitly specify a Service Account for all of your workloads (serviceAccountName in Pod.Spec), and manage their permissions according to the least privilege principle.

    Consider opting out automatic mounting of SA token using automountServiceAccountToken: false on ServiceAccount resource or Pod.spec.

  • KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged:  false policy.

Missing Upstream information in IEC Type 2 Release Notes for R5


26
No









27

Federated Multi-Access Edge Cloud Platform

Deepak Vij


Yes









...