Release 3 Blueprint Scanning Status (Pre-Approval)

• Integrated Cloud Native (ICN) NFV/App stack family [Kuralamudhan Ramakrishnan, Igor Duarte Cardoso]
  • Vuls: High:30 Medium:96 Low:27
  • Lynis: https://logs.akraino.org/intel/bluval_results/icn/master/20200529-023728/results/os/lynis/lynis.log
  • Kube-Hunter: Only 1 vulnerability found, in "Inside-a-Pod Scanning": CAP_NET_RAW

• Radio Edge Cloud (REC)
  • Vuls: High:44 Medium:137 Low:47
  • Lynis: https://wiki.akraino.org/download/attachments/18481239/lynis.log?version=1&modificationDate=1590586718000&api=v2
  • Kube-Hunter:
    • KHV005 Access to API using service account token
    • KHV002 Kubernetes Version Disclosure
    • KHV050 Read access to pod's service account token
    • Local to Pod CAP_NET_RAW Enabled
    • Local to Pod Access to pod's secrets

• Connected Vehicle Blueprint [Thor Chin]
  • This blueprint did not have output information from vuls, lynis or kube-hunter.  I have sent an email to Thor Chin and Tapio Tallgren.  This appears to be an issue with BluVal not executing the scans correctly.
  • Vuls: https://nexus.akraino.org/content/sites/logs/ampere/cvb/logs/cvb_vuls.log
  • Lynis: https://nexus.akraino.org/content/sites/logs/ampere/cvb/logs/cvb_lynis.log
  • Kube-Hunter: Don't have K8s

• ELIOT Iot Gateway Blueprint [Khemendra Kumar]
  • Vuls: High:104 Medium:352 Low:74 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/os/vuls/
  • Lynis: https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/os/lynis/
  • Kube-Hunter:  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/

• ELIOT SD-WAN/WAN Edge/uCPE Blueprint [Khemendra Kumar]
  • Vuls: High:87 Medium:168 Low:62  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/vuls/
  • Lynis:  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/lynis/
  • Kube-Hunter:  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/

• KNI Provider Access Edge [Yolanda Robla Mota]
  • Running on OKD vs Kubernetes  https://wiki.akraino.org/display/AK/KNI+PAE+Architecture+document
  • Conformance tests used:  https://wiki.akraino.org/display/AK/KNI+PAE+Test+document
  • Vuls:
  • Lynis:
  • Kube-Hunter:

• Micro-MEC
  • Scan output files are not currently available at https://wiki.akraino.org/display/AK/Release+3+Planning.  I have emailed the PTL, Tapio Tallgren to see if he can provide them.
  • Vuls:
  • Lynis:
  • Kube-Hunter:

• School/Education Video Security Monitoring [Hechun Zhang and Liya Yu]
  • This blueprint did not have output information from vuls, lynis or kube-hunter.
  • This is the first release for the School/Education Video Security Monitoring blueprint, BluVal is not required. 
  • I have sent an email to Hechun Zhang and Liya Yu.
  • Vuls:
  • Lynis:
  • Kube-Hunter:

• 5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint [Feng Yang]
  • All scan logs:  https://nexus.akraino.org/content/sites/logs/tencent/job/5g-mec-cloud-gaming-CD/security_scan/2/
  • Vuls:
  • Lynis:
  • Kube-Hunter:

• Enterprise Applications on Lightweight 5G Telco Edge [Gaurav Agrawal]
  • Vuls:  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/vuls/
  • Lynis:  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/lynis/
  • Kube-Hunter:  https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/k8s/kube-hunter/

• Public Cloud Edge Interface (PCEI) Blueprint [Oleg Berzin]
  • This blueprint did not have output information from vuls, lynis or kube-hunter. 
  • This is the first release for the PCEI blueprint, BluVal is not required. 
  • I have sent an email to Oleg Berzin.
  • Vuls:
  • Lynis:
  • Kube-Hunter:

Approved Blueprints

...

Vuls Scan

• Pass/Fail
• Exceptions

...

Lynis Scan

• Pass/Fail
• Exceptions

...

Kube-Hunter Scan

• Pass/Fail
• Exceptions

...

5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint

...

• Fail
  • Total: 366 (High:83 Medium:212 Low:71 ?:0), 165/366 Fixed
• Exceptions provided for R3

vuls.log

...

• Pass/w Exceptions

lynis.log

...

• Fail
  • 1 vulnerability found, KHV002,  The K8s version could be obtained from the /version endpoint
• Exceptions provided for R3

kube-hunter.log

...

AI/ML and AR/VR applications at Edge

...

High:61 Medium:280 Low:58

https://nexus.akraino.org/content/sites/logs/ampere/cvb/logs/

...

• ELIOT AIoT in Smart Office Blueprint

...

• ELIOT IoT Gateway Blueprint

...

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/

...

• ELIOT SD-WAN/WAN Edge/uCPE Blueprint

...

High:87 Medium:168 Low:62

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/vuls/

...

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/lynis/

...

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/

...

High:84 Medium:281 Low:59

https://nexus.akraino.org/content/sites/logs/juniper/validation/os/vuls/

...

https://nexus.akraino.org/content/sites/logs/juniper/validation/os/lynis/

...

https://nexus.akraino.org/content/sites/logs/juniper/validation/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/

Approved with exceptions. 

Upgrading K8s components causes the Airship deployment to fail and the regional controller becomes incompatible. The development team was told to use a specific version of the regional controller and airship (as the older versions are stable and newer are in flux and fragile).  When the team upgraded to the new version as per the security team's suggestion, everything else fell apart.  Making this change will require several months of work as the development team has to upgrade a component at a time to bring everything to the latest version of code.

We will address this in the next release. 

...

• Fail:
  • 141 unfixed vulnerabilities
  • (High:30 Medium:96 Low:27 ?:0), 12/153 Fixed
• Exceptions:
  • We request exceptions for all outstanding vulnerabilities
• See Nexus Logs

...

• Pass
• See Nexus Logs

...

• Fail
  • Only 1 vulnerability found, in "Inside-a-Pod Scanning": CAP_NET_RAW
• Exceptions:
  • We request exception for CAP_NET_RAW vulnerability or remediation (fixes found seem to be on a per-pod basis, which is not enough)
• See Nexus Logs

...

• IEC Type 1 for Integrated Edge Cloud (IEC) Blueprint Family

...

• IEC Type 2 for Integrated Edge Cloud (IEC) Blueprint Family

...

• IEC Type 3: Android cloud native applications on Arm servers in edge for Integrated Edge Cloud (IEC) Blueprint Family

...

...

...

• IEC Type 4: AR/VR oriented Edge Stack for Integrated Edge Cloud (IEC) Blueprint Family

...

High:61 Medium:280 Low:58

https://nexus.akraino.org/content/sites/logs/ampere/iec-type4/logs/

...

• IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family

...

High:266 Medium:590 Low:106

https://nexus.akraino.org/content/sites/logs/bytedance/job/type5_security_scan/1/vuls.log

...

Hardening index : [63] [############ ]

https://nexus.akraino.org/content/sites/logs/bytedance/job/type5_security_scan/1/lynis.log

...

...

Fail. We request for exception as we are running OpenShift and not upstream Kubernetes, so we hit several failures: cluster.log , pod.log

https://logs.akraino.org/redhat-kni/bluval_results/blueprint-pae/20200423-071856/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/cluster.log , https://logs.akraino.org/redhat-kni/bluval_results/blueprint-pae/20200423-071856/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter

...

Micro-MEC

...

https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/vuls/

https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/lynis/

...

https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/kube-hunter/

...

• Radio Edge Cloud (REC)

...

...

...

...

• SDN Enabled Broadband Access (SEBA) for Telco Appliance Blueprint Family

...

Time-Critical Edge Compute

...

...

Pass with exceptions

Hardening index : 62 [############ ]

https://nexus.akraino.org/content/sites/logs/cmti/job/lynis/

...

No k8s cluster as part of deployment at the moment

...

High:84 Medium:294 Low:53

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/vuls/

...

Hardening index : [57] [########### ]

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/lynis/

...

cluster.log

KHV002 Information Disclosure

pod.log

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/k8s/kube-hunter/

...

Approved Feature Projects

If the program uses only one programming language, in the “Repository” column, just fill in the repo location.

If a project uses multiple programming languages, please list all of them, add a link in "Repository" column for each programming language to show the sample code.  

...

Akraino Blueprint Validation Framework

...

Akraino Portal Feature Project

...

API Gateway

...