...

Describe  the components of Test set up

Test Bed

Image RemovedImage Added

Test Framework

1. PCEI Deployment Tests

Described in the PCEI R4 Installation Guide

1. PCEI End-to-End Validation Tests

Described in the PCEI R4 End-to-End Validation Guide

1. BluVal Tests

Described in the BluVal Test section of this document.

...

For end-to-end functional verification, a simulated IoT Client was provided. Please refer to PCEI R4 End-to-End Validation Guide.

Test API description

Test APIs NOT USED (except BluVal Robot)

Akraino common tests

NOT PERFORMED

The Test inputs

Test Procedure

...

Blueprint extension tests

The Test inputs

Test Procedure

PCEI R4 Installation Guide

PCEI R4 End-to-End Validation Guide

Expected output

All tests pass

Test Results

Refer to sections of the following documents for detailed test results:

PCEI R4 Installation Guide

PCEI R4 End-to-End Validation Guide

Feature Project Tests

NOT PERFORMED

The Test inputs

Test Procedure

...

cd
bash validation/bluval/blucon.sh pcei

7. Install LFTOOLS:

sudo apt install python3-pip
sudo python3 -m pip install -U pip
sudo python3 -m pip install -U setuptools
sudo -H pip3 install --ignore-installed PyYAML


pip3 install lftools

8. Push BluVal Results to Akraino Nexus

# Create .netrc file
vi .netrc
machine nexus.akraino.org
login <LF ID>
password <Password>

# Archive log files
zip -r results.zip ./results

# Push logs to Nexus
NEXUS_PATH="/pcei/job/v2"
NEXUS_URL="https://nexus.akraino.org/"
/home/onaplab/.local/bin/lftools deploy nexus-zip $NEXUS_URL logs $NEXUS_PATH results.zip

Expected output

Test Results

https://nexus.akraino.org/content/sites/logs/pcei/job/v2/results/

Vuls

CVEs Found:

Lynis

Fixes for Lynis:

BOOT-5122
https://vineetcic.medium.com/how-to-set-grub-password-in-ubuntu-18-03-password-protect-boot-loader-ecb5db184054

PASS_MAX_DAYS
https://askubuntu.com/questions/424216/what-is-password-aging-limits

vi /etc/login.defs
change
PASS_MAX_DAYS 1500
UNMASK 027

NOTE: changing the UNMASK value from default 022 to 027 resulted in the Lynis test suite erroring out. Exception was granted.

KRNL-6000
https://linux-audit.com/understand-and-configure-core-dumps-work-on-linux/
echo "fs.suid_dumpable=0" >> /etc/sysctl.conf
sysctl -p

sysctl -w kernel.dmesg_restrict=1

sysctl -w net.ipv4.conf.all.accept_source_route=0

K8S Conformance

Exception Requested:

...

Kube-Hunter

Vulnerabilities found

Fix for KHV002:

On SUT K8S Cluster:

kubectl replace -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "false"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: system:public-info-viewer
rules:
- nonResourceURLs:
  - /healthz
  - /livez
  - /readyz
  verbs:
  - get
EOF

Fix for KHV005, KHV050

On SUT K8S Cluster:

kubectl replace -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: default
automountServiceAccountToken: false
EOF

Test Dashboards

Single pane view of how the test score looks like for the Blue print.

Additional Testing

None

Bottlenecks/Errata

Please refer to PCEI R4 Release Notes