Release 3 Blueprint Scanning Status (Pre-Approval)

Integrated Cloud Native (ICN) NFV/App stack family [Kuralamudhan Ramakrishnan, Igor Duarte Cardoso]
- Vuls: High:30 Medium:96 Low:27
- Lynis: https://logs.akraino.org/intel/bluval_results/icn/master/20200529-023728/results/os/lynis/lynis.log
- Kube-Hunter: Only 1 vulnerability found, in "Inside-a-Pod Scanning": CAP_NET_RAW

Radio Edge Cloud (REC)
- Vuls: High:44 Medium:137 Low:47
- Lynis: https://wiki.akraino.org/download/attachments/18481239/lynis.log?version=1&modificationDate=1590586718000&api=v2
- Kube-Hunter:
  - KHV005 Access to API using service account token
  - KHV002 Kubernetes Version Disclosure
  - KHV050 Read access to pod's service account token
  - Local to Pod CAP_NET_RAW Enabled
  - Local to Pod Access to pod's secrets

Connected Vehicle Blueprint [Thor Chin]
- This blueprint did not have output information from vuls, lynis or kube-hunter. I have sent an email to Thor Chin and Tapio Tallgren. This appears to be an issue with BluVal not executing the scans correctly.
- Vuls: https://nexus.akraino.org/content/sites/logs/ampere/cvb/logs/cvb_vuls.log
- Lynis: https://nexus.akraino.org/content/sites/logs/ampere/cvb/logs/cvb_lynis.log
- Kube-Hunter: Don't have K8s

ELIOT Iot Gateway Blueprint [Khemendra Kumar]

ELIOT SD-WAN/WAN Edge/uCPE Blueprint [Khemendra Kumar]

KNI Provider Access Edge [Yolanda Robla Mota]
- Running on OKD vs Kubernetes https://wiki.akraino.org/display/AK/KNI+PAE+Architecture+document
- Conformance tests used: https://wiki.akraino.org/display/AK/KNI+PAE+Test+document
- Vuls:
- Lynis:
- Kube-Hunter:

Micro-MEC
- Scan output files are not currently available at https://wiki.akraino.org/display/AK/Release+3+Planning. I have emailed the PTL, Tapio Tallgren to see if he can provide them.
- Vuls:
- Lynis:
- Kube-Hunter:

School/Education Video Security Monitoring [Hechun Zhang and Liya Yu]
- This blueprint did not have output information from vuls, lynis or kube-hunter.
- This is the first release for the School/Education Video Security Monitoring blueprint, BluVal is not required.
- I have sent an email to Hechun Zhang and Liya Yu.
- Vuls:
- Lynis:
- Kube-Hunter:

5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint [Feng Yang]
- All scan logs: https://nexus.akraino.org/content/sites/logs/tencent/job/5g-mec-cloud-gaming-CD/security_scan/2/
- Vuls:
- Lynis:
- Kube-Hunter:

Enterprise Applications on Lightweight 5G Telco Edge [Gaurav Agrawal]

Public Cloud Edge Interface (PCEI) Blueprint [Oleg Berzin]
- This blueprint did not have output information from vuls, lynis or kube-hunter.
- This is the first release for the PCEI blueprint, BluVal is not required.
- I have sent an email to Oleg Berzin.
- Vuls:
- Lynis:
- Kube-Hunter:

Approved Blueprints

	Project Name	Vuls Scan Pass/Fail Exceptions	Lynis Scan Pass/Fail Exceptions	Kube-Hunter Scan Pass/Fail Exceptions
1	5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint	Fail Total: 366 (High:83 Medium:212 Low:71 ?:0), 165/366 Fixed Exceptions provided for R3 vuls.log	Pass/w Exceptions lynis.log	Fail 1 vulnerability found, KHV002, The K8s version could be obtained from the /version endpoint Exceptions provided for R3 kube-hunter.log
2	AI/ML and AR/VR applications at Edge
3	Connected Vehicle Blueprint	High:61 Medium:280 Low:58 https://nexus.akraino.org/content/sites/logs/ampere/cvb/logs/		Kube-Hunter: Exemption granted, this blueprint does not currently use Kubernetes per Thor Chin on 6/17/2020.
4	Edge Video Processing
5	ELIOT: Edge Lightweight and IoT Blueprint Family
6	ELIOT AIoT in Smart Office Blueprint
7	ELIOT IoT Gateway Blueprint	High:104 Medium:352 Low:74 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/os/vuls/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/os/lynis/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/iotgateway/job/eliot-iotgateway-deploy-k8s-virtual-daily-master/430/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/
8	ELIOT SD-WAN/WAN Edge/uCPE Blueprint	High:87 Medium:168 Low:62 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/vuls/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/os/lynis/	https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/378/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/
9	Network Cloud and TF Integration Project	High:84 Medium:281 Low:59 https://nexus.akraino.org/content/sites/logs/juniper/validation/os/vuls/	https://nexus.akraino.org/content/sites/logs/juniper/validation/os/lynis/	https://nexus.akraino.org/content/sites/logs/juniper/validation/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/ Approved with exceptions. Upgrading K8s components causes the Airship deployment to fail and the regional controller becomes incompatible. The development team was told to use a specific version of the regional controller and airship (as the older versions are stable and newer are in flux and fragile). When the team upgraded to the new version as per the security team's suggestion, everything else fell apart. Making this change will require several months of work as the development team has to upgrade a component at a time to bring everything to the latest version of code. We will address this in the next release.
10	Integrated Cloud Native NFV/App stack family (Short term: ICN)	Fail: 141 unfixed vulnerabilities (High:30 Medium:96 Low:27 ?:0), 12/153 Fixed Exceptions: We request exceptions for all outstanding vulnerabilities See Nexus Logs	Pass See Nexus Logs	Fail Only 1 vulnerability found, in "Inside-a-Pod Scanning": CAP_NET_RAW Exceptions: We request exception for CAP_NET_RAW vulnerability or remediation (fixes found seem to be on a per-pod basis, which is not enough) See Nexus Logs
11	Integrated Edge Cloud (IEC) Blueprint Family
12	IEC Type 1 for Integrated Edge Cloud (IEC) Blueprint Family
13	IEC Type 2 for Integrated Edge Cloud (IEC) Blueprint Family
14	IEC Type 3: Android cloud native applications on Arm servers in edge for Integrated Edge Cloud (IEC) Blueprint Family	High:266 Medium:590 Low:106 IEC_Type3_vuls.log	IEC_Type3_lynis.log	First Release - Kube-Hunter security scan not required.
15	IEC Type 4: AR/VR oriented Edge Stack for Integrated Edge Cloud (IEC) Blueprint Family	High:61 Medium:280 Low:58 https://nexus.akraino.org/content/sites/logs/ampere/iec-type4/logs/		Kube-Hunter: Exemption granted, this blueprint does not currently use Kubernetes per Thor Chin on 6/17/2020.
16	IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family	High:266 Medium:590 Low:106 https://nexus.akraino.org/content/sites/logs/bytedance/job/type5_security_scan/1/vuls.log	Hardening index : [63] [############ ] https://nexus.akraino.org/content/sites/logs/bytedance/job/type5_security_scan/1/lynis.log	Kube-Hunter: Exemption granted, this blueprint does not currently use Kubernetes.
17	Kubernetes-Native Infrastructure (KNI) Blueprint Family	We have RHCOS on our cluster, so vuls doesn't apply to it vuls-kni.log	lynis.log	Fail. We request for exception as we are running OpenShift and not upstream Kubernetes, so we hit several failures: cluster.log , pod.log https://logs.akraino.org/redhat-kni/bluval_results/blueprint-pae/20200423-071856/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter/cluster.log , https://logs.akraino.org/redhat-kni/bluval_results/blueprint-pae/20200423-071856/results/k8s/kube-hunter/Kube-Hunter.Kube-Hunter
18	Micro-MEC	First release - security scan not required.	First release - security scan not required.	First release - security scan not required.
19	The AI Edge: School/Education Video Security Monitoring	https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/vuls/	https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/lynis/	https://nexus.akraino.org/content/sites/logs/baidu/job/security_scan/aiedge/1/kube-hunter/
20	Network Cloud Blueprint Family
21	StarlingX Far Edge Distributed Cloud
22	Telco Appliance Blueprint Family
23	Radio Edge Cloud (REC)	Fail with Exceptions 0 CVEs are detected with OVA 0 CVEs are detected with CPE 0 CVEs are detected with GitHub Security Alerts 0 exploits are detected 248 unfixed CVEs are detected with gost Total: 228 (High:44 Medium:137 Low:47 ?:0), 0/228 Fixed, 824 installed, 0 updatable, 0 exploits, en: 5, ja: 0 alerts vuls.log	Pass with Exceptions Tests performed: 287 Total tests: 449 Active plugins: 2 "Total plugins: 2 Warnings: 2" Found accounts without password [AUTH-9283] https://cisofy.com/lynis/controls/AUTH-9283/ Note: these accounts are not allowed to logon. YUM is not properly configured or registered for this platform (no repolist found) [PKGS-7383] https://cisofy.com/lynis/controls/PKGS-7383/ Note: This is intentional to prevent anyone from installing software lynis.log	Pass with Exceptions All Critical Tests Passed Cluster Remote Scanning Passed Node Remote Scanning Passed Inside-a-Pod Scanning Known Vulnerablities Found KHV005 Access to API using service account token KHV002 Kubernetes Version Disclosure KHV050 Read access to pod's service account token Local to Pod CAP_NET_RAW Enabled Local to Pod Access to pod's secrets pod.log cluster.log
24	SDN Enabled Broadband Access (SEBA) for Telco Appliance Blueprint Family
25	The AI Edge Blueprint Family
26	Time-Critical Edge Compute
27	Public Cloud Edge Interface	Pass with exceptions High:41 Medium:239 Low:32 https://nexus.akraino.org/content/sites/logs/cmti/job/vuls/	Pass with exceptions Hardening index : 62 [############ ] https://nexus.akraino.org/content/sites/logs/cmti/job/lynis/	No k8s cluster as part of deployment at the moment
28	Enterprise Applications on Lightweight 5G Telco Edge	High:84 Medium:294 Low:53 https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/vuls/	Hardening index : [57] [########### ] https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/os/lynis/	cluster.log KHV002 Information Disclosure pod.log https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/22/results/k8s/kube-hunter/
29
30

Approved Feature Projects

If the program uses only one programming language, in the “Repository” column, just fill in the repo location.

If a project uses multiple programming languages, please list all of them, add a link in "Repository" column for each programming language to show the sample code.

	Project Name	Programming Languages	Repository	SonarQube Enabled	Notes
1	Akraino Blueprint Validation Framework
2	Akraino Portal Feature Project
4	Akraino Profiling
5	Akraino Regional Controller
6	API Gateway
7	Backup and Restore (Snappy) Feature Project
8	Cluster Health & Overload Monitoring Platform (CHOMP) Feature Project
9	MEC API Framework
10	Support of OVS-DPDK in Airship

Security Scan Status

Release 3 Blueprint Scanning Status (Pre-Approval)

Approved Blueprints

Approved Feature Projects