Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

No.Project NameTSC Subgroup Release StatusIs this your first release 

Blue Print Stage

  • Self-Certify
  • Incubation
  • Mature
  • Core

CD Logs URL to be used for review

(Column filled in by PTLs)

How to: Push Logs to Nexus

Jenkins Master for Private Lab

Jenkins Peering Guide

Example: 

KubeEdge BP Test Documents

Link to executive one pager

(editable doc format)

(Column filled in by PTLs)

API Info Reporting Review

(Column filled in by API Subcommittee)

(note for PTLs – go here for steps to fill in project API info form)

BluVal

Certification

Bluval User Guide

Security

Certification

Provide link to Vuls, Lynis, and Kube-Hunter logs below.

Pass/Fail Criteria:  Steps To Implement Security Scan Requirements

Exception requests should be filed at:

Release 5: Akraino CVE Vulnerability Exception Request

Upstream Review (Column filled by Upstream Subcommittee and PTLs)


(note PTL can go to Release 5 BP/Feature Upstream Status to find details)

Date ready for TSC review

(Column filled in by PTLs)

 TSC Review Date

(Column filled in by TSC)


1

Mature
CVB_Akraino_R5_blueprint_Datasheet.docxPer e-mail from WANG Tao (Tucker Wang) 20Aug21, no changes from R4

Completed by 8/24/2021


2

Mature








3














4
NoIncubation

ICN Master Bare Metal Deployment Verifier

ICN Master Virtual Deployment Verifier

ICN R5 DatasheetPer notice from Kural 5Aug21, no change from R4

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/os/lynis/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/os/vuls/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20210707-182026/results/k8s/kube-hunter/

Filed Release 5: Akraino CVE Vulnerability Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted 

Completed by 8/6/2021


5
YesIncubationhttps://nexus.akraino.org/content/sites/logs/intel/ICN_CD_logs/pod11-node5/icn-master-bm-verify-bm_verifer-kata/12/ICN-MTSCN R5 Datasheet

API form uploaded 24 May

e-mail questions exchanged 20Jul21

Scheduled for review by API subcommittee  

API subcommittee review completed and info accepted  

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/os/lynis/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210712-025145/results/os/vuls/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/k8s/conformance/

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master-kata/20210624-025354/results/k8s/kube-hunter/

Filed Release 5: Akraino CVE Vulnerability Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted 

Completed by 8/10/2021


6
NoIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/eliot-build/18/home/jenkins/log/Per e-mail from Khemendra 26Aug21, no changes from R4

https://nexus.akraino.org/content/sites/logs/huawei/job/eliot-security-validation-build/4/results/


Akraino BluVal Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed 8/6/2021


7
NOIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/eliot-uCPE-build/15/home/jenkins/log/ELIOT R5 - SD-WAN / WAN Edge / uCPE Data SheetPer e-mail from Khemendra 26Aug21, no changes from R4

https://nexus.akraino.org/content/sites/logs/huawei/job/eliot-uCPE-security-build/10/results/


Akraino BluVal Exception Request

Incubation Level Review Results:

 

VulsAccepted with exceptions shown at:

Release 5 Vuls Exception Request

____________________________________________________________

LynisAccepted 

____________________________________________________________

Kube-Hunter: 

  Cluster:  Accepted 

  Pod:  Accepted with exceptions shown at:

Release 5 Blueprint Scanning Status

Completed on 8/6/2021


8
No

https://nexus.akraino.org/content/sites/logs/juniper/validation-2021/

Blueprint Data SheetPer e-mail from Sukhdev 5Aug21, no change from R4Not required as there is no change from Release 4
Completed by 8/10/2021


9
NoIncubationhttps://jenkins.akraino.org/job/kni-blueprint-pae-verify-deploy-gcp/69/

Per e-mail from Ricardo 10Aug21, he uploaded R5 API info forms for both KNI blueprints, with no substantive changes from R4. The API subcommittee has a review scheduled for of the new API info forms and will update this table afterwards

On the API Subcommittee reviewed and accepted the R5 API form


https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results/

Incubation Level Review Results:

Vuls:  Need to provide vul.log output file

__________________________________________________________

20 Jul

Lynis: FAILED

test ID AUTH-9328 (Default umask values)Suggestion

:

Default umask in /etc/login.defs could be more strict like 027
  • sysctl key kernel.dmesg_restrictSuggestion:  value should be set to '1'
  • sysctl key net.ipv4.conf.default.accept_source_routeSuggestion:  value should be set to '0'

     Accepted 

    ____________________________________________________________

    Output manually generated, located at:

    Release 5 Security Scan Manual Logs

    Kube-Hunter: 

      Cluster:  Accepted 

      Pod:  Accepted with exceptions shown at:

    Release 5 Blueprint Scanning Status

    Completed by 8/10/2021


    10
    NoIncubation

    Management Hub:

    https://logs.akraino.org/production/vex-yul-akraino-jenkins-prod-1/kni-blueprint-management-hub-verify-deploy-gcp/19/

    Industrial Edge:

    https://logs.akraino.org/production/vex-yul-akraino-jenkins-prod-1/kni-blueprint-ie-verify-deploy-gcp/4/

    See above note


    https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results/

    Incubation Level Review Results:

    Vuls:  Need to provide vul.log output file

    __________________________________________________________

    20 Jul

    Lynis: FAILED

    test ID AUTH-9328 (Default umask values)Suggestion

    :

    Default umask in /etc/login.defs could be more strict like 027
  • sysctl key kernel.dmesg_restrictSuggestion:  value should be set to '1'
  • sysctl key net.ipv4.conf.default.accept_source_routeSuggestion:  value should be set to '0'

     Accepted 

    ____________________________________________________________

    Output manually generated, located at:

    Release 5 Security Scan Manual Logs

    Kube-Hunter: 

      Cluster:  Accepted 

      Pod:  Accepted with exceptions shown at:

    Release 5 Blueprint Scanning Status

    Completed by 8/10/2021


    11

    Micro-MEC

    Ferenc Székely






    Ashvin Kumar uploaded API info form. API subcommittee review scheduled for  







    12











    13
    No
    • Incubation
    https://nexus.akraino.org/content/sites/logs/fate/job/I-VICS/5/Intelligent Vehicle-Infrastructure Cooperation System(I-VICS) Datasheet

    Per e-mail from Zhuming Zhang (Sihui Wang) 30Aug21, no changes from R4

    https://nexus.akraino.org/content/sites/logs/fate/job/I-VICS/5/No new features or bugs have been added after R4 releaseMissing Upstream information


    14

    TSC 2021-08-17 (Tuesday) 7:00 am Pacific

    No
    https://nexus.akraino.org/content/sites/logs/tencent/job/tencent_5g_mec/Per e-mail from Eagan Fu 15Aug21, no change from R4

    Completed by 8/24/2021


    15











    16
    NoIncubationhttps://nexus.akraino.org/content/sites/logs/cmti/job/iec5_r4/15/IEC Release4-SmartNIC datasheet.docxPer e-mail from Leo 11Aug21, no change from R4

    Bluval Exception has been accepted for the project.

    Akraino BluVal Exception Request


    R5 Release Notes of IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family


    Completed by 8/30/2021




    17
    NoIncubationhttps://nexus.akraino.org/content/sites/logs/huawei/job/ealt-edge-build/51/home/jenkins/log/EALTEDGE Release 5 DatasheetPer e-mail from Khemendra 20Aug21 (with Gaurav cc'd), no changes from R4

    https://nexus.akraino.org/content/sites/logs/huawei/job/ealt-security-validation-build/19/results/


    Akraino BluVal Exception Request

    Incubation Level Review Results:

     

    VulsAccepted with exceptions shown at:

    Release 5 Vuls Exception Request

    ____________________________________________________________

    LynisAccepted 

    ____________________________________________________________

    Kube-Hunter: 

      Cluster:  Accepted 

      Pod:  Accepted with exceptions shown at:

    Release 5 Blueprint Scanning Status

    R5 - Architecture Documentation of Enterprise Applications on Lightweight 5G Telco Edge


    Completed by 8/10/2021




    18TSC 2021-08-10 (Tuesday) 7:00 am PacificNo
    https://nexus.akraino.org/content/sites/logs/cmti/job/pcei-daily/https://wiki.akraino.org/x/lwHkAg

    Per API Subcommittee meeting 30Jul21, no change from R4

    PCEI R5 API Doc:

    https://wiki.akraino.org/x/qgHkAg

    Incubation Level Review Results:

     

    VulsAccepted with exceptions shown at:

    Release 5 Vuls Exception Request

    ____________________________________________________________

    Lynis:  Accepted with exceptions shown at:

    Release 5 Blueprint Scanning Status

    ____________________________________________________________

    Kube-Hunter: 

      Cluster:  Accepted 

      Pod:  Accepted with exceptions shown at:

    Release 5 Blueprint Scanning Status

    PCEI R5 Release Notes

    https://wiki.akraino.org/x/LgLkAg



    Completed by 8/6/2021

     



    19
    No
    • Incubation
    https://nexus.akraino.org/content/sites/logs/fate/job/Fate_test/15/Akraino R5 Federated ML blueprint datasheet.docxPer e-mail from Zifan 8Aug21, no change from R4

    Incubation Level Review Results:

     

    VulsAccepted with exceptions shown at:

    Release 5 Vuls Exception Request

    __________________________________________________________

    LynisAccepted

    __________________________________________________________

    Kube-Hunter:  Exception granted:  K8s not used by this BP.

    federated ML

    Release Notes

    R5 Federated ML application at edge Release Notes


    Completed by 8/30/2021




    20











    21

    TSC 2021-08-03 (Tuesday) 7:00 am Pacific

    NoIncubationhttps://nexus.akraino.org/content/sites/logs/juniper/job/Private%205G%20BP/Akraino Private LTE/5G BP DatasheetPer e-mail from Prem 27Aug21, no change from R4

    Completed by 8/10/2021


    22











    23
    Yes
    https://nexus.akraino.org/content/sites/logs/myais/job/parsec/10/







    24

    MEC-based Stable Topology Prediction for Vehicular Networks

    Asif Mehmood













    25
    NoIncubationhttps://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/cdlogs/

    https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/conformance/


    https://nexus.akraino.org/content/sites/logs/arm-china/jenkins092/iec-type2-terraform/blueval/k8s/kube-hunter/

     

    Vuls: Need to provide vuls.log output file

    __________________________________________________________

    LynisNeed to provide lynis.log output file

    __________________________________________________________

    Kube-Hunter: 

      Cluster: The following vulnerabilities must be fixed:

    • KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.
    • KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged: false policy.

      Pod:  The following vulnerabilities must be fixed:

    • Access to pod's secrets

      Suggestion: 

      https://blog.aquasec.com/managing-kubernetes-secrets

      Securing etcdsecret data is stored in etcd. By default, etcd data is not encrypted and neither are your secrets. You should enable encryption at rest, limit access to etcd to admin users only, and safely dispose of disks where etcd data was formerly stored

      Use SSL/TLSwhen running etcd in a cluster, you must use secure peer-to-peer communication.

    • Exposed PodsDescription:  An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint.
    • KHV043 - Cluster Health DisclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

    • KHV007 - Specific Access to Kubernetes API Suggestion:  Review the RBAC permissions to Kubernetes API server for the anonymous and default service account

    • KHV005 - Access to Kubernetes API

    • KHV002 - Kubernetes version disclosureSuggestion:  Disable --enable-debugging-handlers kubelet flag.

    • KHV050 - Read access to Pod service account token

      Suggestion:  It is recommended to explicitly specify a Service Account for all of your workloads (serviceAccountName in Pod.Spec), and manage their permissions according to the least privilege principle.

      Consider opting out automatic mounting of SA token using automountServiceAccountToken: false on ServiceAccount resource or Pod.spec.

    • KHV044 - Privileged ContainerSuggestion:  Minimize the use of privileged containers. Use Pod Security Policies to enforce using privileged:  false policy.

    Missing Upstream information in IEC Type 2 Release Notes for R5


    26
    No









    27

    Federated Multi-Access Edge Cloud Platform

    Deepak Vij


    Yes









    ...