Release 3 Blueprint Scanning Status (Pre-Approval)

Integrated Cloud Native (ICN) NFV/App stack family [Kuralamudhan Ramakrishnan, Igor Duarte Cardoso]
- Vuls: High:30 Medium:96 Low:27
- Lynis: https://logs.akraino.org/intel/bluval_results/icn/master/20200529-023728/results/os/lynis/lynis.log
- Kube-Hunter: Only 1 vulnerability found, in "Inside-a-Pod Scanning": CAP_NET_RAW

Radio Edge Cloud (REC)
- Vuls: High:44 Medium:137 Low:47
- Lynis: https://wiki.akraino.org/download/attachments/18481239/lynis.log?version=1&modificationDate=1590586718000&api=v2
- Kube-Hunter:
  - KHV005 Access to API using service account token
  - KHV002 Kubernetes Version Disclosure
  - KHV050 Read access to pod's service account token
  - Local to Pod CAP_NET_RAW Enabled
  - Local to Pod Access to pod's secrets

Connected Vehicle Blueprint [Thor Chin]
- This blueprint did not have output information from vuls, lynis or kube-hunter. I have sent an email to Thor Chin and Tapio Tallgren. This appears to be an issue with BluVal not executing the scans correctly.
- Vuls:
- Lynis:
- Kube-Hunter:

ELIOT Iot Gateway Blueprint [Khemendra Kumar]

ELIOT SD-WAN/WAN Edge/uCPE Blueprint [Khemendra Kumar]

KNI Provider Access Edge [Yolanda Robla Mota]
- Running on OKD vs Kubernetes https://wiki.akraino.org/display/AK/KNI+PAE+Architecture+document
- Conformance tests used: https://wiki.akraino.org/display/AK/KNI+PAE+Test+document
- Vuls:
- Lynis:
- Kube-Hunter:

Micro-MEC
- Scan output files are not currently available at https://wiki.akraino.org/display/AK/Release+3+Planning. I have emailed the PTL, Tapio Tallgren to see if he can provide them.
- Vuls:
- Lynis:
- Kube-Hunter:

School/Education Video Security Monitoring [Hechun Zhang and Liya Yu]
- This blueprint did not have output information from vuls, lynis or kube-hunter.
- This is the first release for the School/Education Video Security Monitoring blueprint, BluVal is not required.
- I have sent an email to Hechun Zhang and Liya Yu.
- Vuls:
- Lynis:
- Kube-Hunter:

5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint [Feng Yang]
- All scan logs: https://nexus.akraino.org/content/sites/logs/tencent/job/5g-mec-cloud-gaming-CD/security_scan/2/
- Vuls:
- Lynis:
- Kube-Hunter:

Enterprise Applications on Lightweight 5G Telco Edge [Gaurav Agrawal]

Public Cloud Edge Interface (PCEI) Blueprint [Oleg Berzin]
- This blueprint did not have output information from vuls, lynis or kube-hunter.
- This is the first release for the PCEI blueprint, BluVal is not required.
- I have sent an email to Oleg Berzin.
- Vuls:
- Lynis:
- Kube-Hunter:

Approved Blueprints

	Project Name	Vuls Scan Pass/Fail Exceptions	Lynis Scan Pass/Fail Exceptions	Kube-Hunter Scan Pass/Fail Exceptions
1	5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint	Fail Total: 366 (High:83 Medium:212 Low:71 ?:0), 165/366 Fixed Exceptions provided for R3 vuls.log	Pass/w Exceptions lynis.log	Fail 1 vulnerability found, KHV002, The K8s version could be obtained from the /version endpoint Exceptions provided for R3 kube-hunter.log
2	AI/ML and AR/VR applications at Edge
3	Connected Vehicle Blueprint
4	Edge Video Processing
5	ELIOT: Edge Lightweight and IoT Blueprint Family
6	ELIOT AIoT in Smart Office Blueprint
7	ELIOT IoT Gateway Blueprint	High:104 Medium:352 Low:74 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/os/vuls/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/os/lynis/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/
8	ELIOT SD-WAN/WAN Edge/uCPE Blueprint	High:87 Medium:168 Low:62 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/vuls/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/lynis/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/
9	Network Cloud and TF Integration Project	High:84 Medium:281 Low:59 https://nexus.akraino.org/content/sites/logs/juniper/validation/os/vuls/	https://nexus.akraino.org/content/sites/logs/juniper/validation/os/lynis/	https://nexus.akraino.org/content/sites/logs/juniper/validation/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/
10	Integrated Cloud Native NFV/App stack family (Short term: ICN)	Fail: 141 unfixed vulnerabilities (High:30 Medium:96 Low:27 ?:0), 12/153 Fixed Exceptions: We request exceptions for all outstanding vulnerabilities See Nexus Logs	Pass See Nexus Logs	Fail Only 1 vulnerability found, in "Inside-a-Pod Scanning": CAP_NET_RAW Exceptions: We request exception for CAP_NET_RAW vulnerability or remediation (fixes found seem to be on a per-pod basis, which is not enough) See Nexus Logs
11	Integrated Edge Cloud (IEC) Blueprint Family
12	IEC Type 1 for Integrated Edge Cloud (IEC) Blueprint Family
13	IEC Type 2 for Integrated Edge Cloud (IEC) Blueprint Family
14	IEC Type 4: AR/VR oriented Edge Stack for Integrated Edge Cloud (IEC) Blueprint Family
15	Kubernetes-Native Infrastructure (KNI) Blueprint Family	We have RHCOS on our cluster, so vuls doesn't apply to it vuls-kni.log	lynis.log	Fail. We request for exception as we are running OpenShift and not upstream Kubernetes, so we hit several failures: cluster.log , pod.log https://logs.akraino.org/redhat-kni/bluval_results/blueprint-pae/20200423-071856/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/cluster.log , https://logs.akraino.org/redhat-kni/bluval_results/blueprint-pae/20200423-071856/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter
16	Micro-MEC
17	The AI Edge: School/Education Video Security Monitoring	https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/vuls/	https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/lynis/	https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/kube-hunter/
18	Network Cloud Blueprint Family
19	StarlingX Far Edge Distributed Cloud
20	Telco Appliance Blueprint Family
21	Radio Edge Cloud (REC)	Fail with Exceptions 0 CVEs are detected with OVA 0 CVEs are detected with CPE 0 CVEs are detected with GitHub Security Alerts 0 exploits are detected 248 unfixed CVEs are detected with gost Total: 228 (High:44 Medium:137 Low:47 ?:0), 0/228 Fixed, 824 installed, 0 updatable, 0 exploits, en: 5, ja: 0 alerts vuls.log	Pass with Exceptions Tests performed: 287 Total tests: 449 Active plugins: 2 "Total plugins: 2 Warnings: 2" Found accounts without password [AUTH-9283] https://cisofy.com/lynis/controls/AUTH-9283/ Note: these accounts are not allowed to logon. YUM is not properly configured or registered for this platform (no repolist found) [PKGS-7383] https://cisofy.com/lynis/controls/PKGS-7383/ Note: This is intentional to prevent anyone from installing software lynis.log	Pass with Exceptions All Critical Tests Passed Cluster Remote Scanning Passed Node Remote Scanning Passed Inside-a-Pod Scanning Known Vulnerablities Found KHV005 Access to API using service account token KHV002 Kubernetes Version Disclosure KHV050 Read access to pod's service account token Local to Pod CAP_NET_RAW Enabled Local to Pod Access to pod's secrets pod.log cluster.log
22	SDN Enabled Broadband Access (SEBA) for Telco Appliance Blueprint Family
23	The AI Edge Blueprint Family
24	Time-Critical Edge Compute
25	Public Cloud Edge Interface	Pass with exceptions High:41 Medium:239 Low:32 https://nexus.akraino.org/content/sites/logs/cmti/job/vuls/	Pass with exceptions Hardening index : 62 [############ ] https://nexus.akraino.org/content/sites/logs/cmti/job/lynis/	No k8s cluster as part of deployment at the moment
26	Enterprise Applications on Lightweight 5G Telco Edge	High:84 Medium:294 Low:53 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/vuls/	Hardening index : [57] [########### ] https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/lynis/	cluster.log KHV002 Information Disclosure pod.log https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/k8s/kube-hunter/
27
28

Approved Feature Projects

If the program uses only one programming language, in the “Repository” column, just fill in the repo location.

If a project uses multiple programming languages, please list all of them, add a link in "Repository" column for each programming language to show the sample code.

	Project Name	Programming Languages	Repository	SonarQube Enabled	Notes
1	Akraino Blueprint Validation Framework
2	Akraino Portal Feature Project
4	Akraino Profiling
5	Akraino Regional Controller
6	API Gateway
7	Backup and Restore (Snappy) Feature Project
8	Cluster Health & Overload Monitoring Platform (CHOMP) Feature Project
9	MEC API Framework
10	Support of OVS-DPDK in Airship

Space shortcuts

Page tree

Release 3 Blueprint Scanning Status (Pre-Approval)

Approved Blueprints

Approved Feature Projects

Space shortcuts

Page tree

Security Scan Status

Release 3 Blueprint Scanning Status (Pre-Approval)

Approved Blueprints

Approved Feature Projects