Skip to content

Commit 5827484

Browse files
Court72Court72
authored
Merge pull request #279365 from Hacks4Snacks/graymark/nexuscvereport
[operator-nexus] Add cluster-cve-report command
2 parents 2a69eb4 + d99a5cd commit 5827484

File tree

1 file changed

+226
-0
lines changed

1 file changed

+226
-0
lines changed

‎articles/operator-nexus/howto-baremetal-run-data-extract.md

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,10 @@ The current list of supported commands are
5656
Command Name: `hardware-rollup-status`\
5757
Arguments: None
5858

59+
- [Generate Cluster CVE Report](#generate-cluster-cve-report)\
60+
Command Name: `cluster-cve-report`\
61+
Arguments: None
62+
5963
The command syntax is:
6064

6165
```azurecli-interactive
@@ -307,6 +311,228 @@ __Example JSON Collected__
307311
[..snip..]
308312
```
309313

314+
### Generate Cluster CVE Report
315+
316+
Vulnerability data is collected with the `cluster-cve-report` command and formatted as JSON to `{year}-{month}-{day}-nexus-cluster-vulnerability-report.json`. The JSON file is found in the data extract zip file located in the storage account. The data collected will include vulnerability data per container image in the cluster.
317+
318+
This example executes the `cluster-cve-report` command without arguments.
319+
320+
> [!NOTE]
321+
> The target machine must be a control-plane node or the action will not execute.
322+
323+
```azurecli
324+
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
325+
--resource-group "cluster_MRG" \
326+
--subscription "subscription" \
327+
--commands '[{"command":"cluster-cve-report"}]' \
328+
--limit-time-seconds 600
329+
```
330+
331+
__`cluster-cve-report` Output__
332+
333+
```azurecli
334+
====Action Command Output====
335+
Nexus cluster vulnerability report saved.
336+
337+
338+
================================
339+
Script execution result can be found in storage account:
340+
https://cmkfjft8twwpst.blob.core.windows.net/bmm-run-command-output/20b217b5-ea38-4394-9db1-21a0d392eff0-action-bmmdataextcmd.tar.gz?se=2023-09-19T18%3A47%3A17Z&sig=ZJcsNoBzvOkUNL0IQ3XGtbJSaZxYqmtd%3D&sp=r&spr=https&sr=b&st=2023-09-19T14%3A47%3A17Z&sv=2019-12-12
341+
```
342+
343+
__CVE Report Schema__
344+
345+
```JSON
346+
{
347+
"$schema": "http://json-schema.org/draft-07/schema#",
348+
"title": "Vulnerability Report",
349+
"type": "object",
350+
"properties": {
351+
"metadata": {
352+
"type": "object",
353+
"properties": {
354+
"dateRetrieved": {
355+
"type": "string",
356+
"format": "date-time",
357+
"description": "The date and time when the data was retrieved."
358+
},
359+
"platform": {
360+
"type": "string",
361+
"description": "The name of the platform."
362+
},
363+
"resource": {
364+
"type": "string",
365+
"description": "The name of the resource."
366+
},
367+
"runtimeVersion": {
368+
"type": "string",
369+
"description": "The version of the runtime."
370+
},
371+
"managementVersion": {
372+
"type": "string",
373+
"description": "The version of the management software."
374+
},
375+
"vulnerabilitySummary": {
376+
"type": "object",
377+
"properties": {
378+
"criticalCount": {
379+
"type": "integer",
380+
"description": "Number of critical vulnerabilities."
381+
},
382+
"highCount": {
383+
"type": "integer",
384+
"description": "Number of high severity vulnerabilities."
385+
},
386+
"mediumCount": {
387+
"type": "integer",
388+
"description": "Number of medium severity vulnerabilities."
389+
},
390+
"lowCount": {
391+
"type": "integer",
392+
"description": "Number of low severity vulnerabilities."
393+
},
394+
"noneCount": {
395+
"type": "integer",
396+
"description": "Number of vulnerabilities with no severity."
397+
},
398+
"unknownCount": {
399+
"type": "integer",
400+
"description": "Number of vulnerabilities with unknown severity."
401+
}
402+
},
403+
"required": ["criticalCount", "highCount", "mediumCount", "lowCount", "noneCount", "unknownCount"]
404+
}
405+
},
406+
"required": ["dateRetrieved", "platform", "resource", "runtimeVersion", "managementVersion", "vulnerabilitySummary"]
407+
},
408+
"containers": {
409+
"type": "object",
410+
"additionalProperties": {
411+
"type": "array",
412+
"items": {
413+
"type": "object",
414+
"properties": {
415+
"namespace": {
416+
"type": "string",
417+
"description": "The namespace of the container."
418+
},
419+
"digest": {
420+
"type": "string",
421+
"description": "The digest of the container image."
422+
},
423+
"os": {
424+
"type": "object",
425+
"properties": {
426+
"family": {
427+
"type": "string",
428+
"description": "The family of the operating system."
429+
}
430+
},
431+
"required": ["family"]
432+
},
433+
"summary": {
434+
"type": "object",
435+
"properties": {
436+
"criticalCount": {
437+
"type": "integer",
438+
"description": "Number of critical vulnerabilities in this container."
439+
},
440+
"highCount": {
441+
"type": "integer",
442+
"description": "Number of high severity vulnerabilities in this container."
443+
},
444+
"lowCount": {
445+
"type": "integer",
446+
"description": "Number of low severity vulnerabilities in this container."
447+
},
448+
"mediumCount": {
449+
"type": "integer",
450+
"description": "Number of medium severity vulnerabilities in this container."
451+
},
452+
"noneCount": {
453+
"type": "integer",
454+
"description": "Number of vulnerabilities with no severity in this container."
455+
},
456+
"unknownCount": {
457+
"type": "integer",
458+
"description": "Number of vulnerabilities with unknown severity in this container."
459+
}
460+
},
461+
"required": ["criticalCount", "highCount", "lowCount", "mediumCount", "noneCount", "unknownCount"]
462+
},
463+
"vulnerabilities": {
464+
"type": "array",
465+
"items": {
466+
"type": "object",
467+
"properties": {
468+
"title": {
469+
"type": "string",
470+
"description": "Title of the vulnerability."
471+
},
472+
"vulnerabilityID": {
473+
"type": "string",
474+
"description": "Identifier of the vulnerability."
475+
},
476+
"fixedVersion": {
477+
"type": "string",
478+
"description": "The version in which the vulnerability is fixed."
479+
},
480+
"installedVersion": {
481+
"type": "string",
482+
"description": "The currently installed version."
483+
},
484+
"referenceLink": {
485+
"type": "string",
486+
"format": "uri",
487+
"description": "Link to the vulnerability details."
488+
},
489+
"publishedDate": {
490+
"type": "string",
491+
"format": "date-time",
492+
"description": "The date when the vulnerability was published."
493+
},
494+
"score": {
495+
"type": "number",
496+
"description": "The CVSS score of the vulnerability."
497+
},
498+
"severity": {
499+
"type": "string",
500+
"description": "The severity level of the vulnerability."
501+
},
502+
"resource": {
503+
"type": "string",
504+
"description": "The resource affected by the vulnerability."
505+
},
506+
"target": {
507+
"type": "string",
508+
"description": "The target of the vulnerability."
509+
},
510+
"packageType": {
511+
"type": "string",
512+
"description": "The type of the package."
513+
},
514+
"exploitAvailable": {
515+
"type": "boolean",
516+
"description": "Indicates if an exploit is available for the vulnerability."
517+
}
518+
},
519+
"required": ["title", "vulnerabilityID", "fixedVersion", "installedVersion", "referenceLink", "publishedDate", "score", "severity", "resource", "target", "packageType", "exploitAvailable"]
520+
}
521+
}
522+
},
523+
"required": ["namespace", "digest", "os", "summary", "vulnerabilities"]
524+
}
525+
}
526+
}
527+
},
528+
"required": ["metadata", "containers"]
529+
}
530+
```
531+
532+
__CVE Data Details__
533+
534+
The CVE data is refreshed per container image every 24-hours based on Kubernetes resource instantiation or whenever there is a change to the Kubernetes resource referencing the image (whichever occurs first).
535+
310536
## Viewing the Output
311537

312538
Note the provided link to the tar.gz zipped file from the command execution. The tar.gz file name identifies the file in the Storage Account of the Cluster Manager resource group. You can also use the link to directly access the output zip file. The tar.gz file also contains the zipped extract command file outputs. Download the output file from the storage blob to a local directory by specifying the directory path in the optional argument `--output-directory`.

0 commit comments

Comments
 (0)