Skip to content

Commit 2372ffa

Browse files
authored
Merge pull request #765 from sassoftware/security-policy
Security Policy MD created based on template
2 parents c72b5cc + 8855b2b commit 2372ffa

File tree

2 files changed

+84
-30
lines changed

2 files changed

+84
-30
lines changed

.github/workflows/build-artifact/ARTIFACT_INVENTORY.template

Lines changed: 29 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -5,64 +5,63 @@ The following tables provide information about the container images and Helm cha
55
* pre-pull container images
66
* deploy into an air-gapped Kubernetes cluster
77

8-
**Note:** For more information about deploying in an air-gapped environment, refer to
8+
**Note:** For more information about deploying in an air-gapped environment, refer to
99
[Configure SAS Viya Monitoring for Kubernetes for an Air-Gapped Environment](https://documentation.sas.com/?cdcId=obsrvcdc&cdcVersion=v_003&docsetId=obsrvdply&docsetTarget=n0auhd4hutsf7xn169hfvriysz4e.htm#n0grd8g2pkfglin12bzm3g1oik2p).
1010

1111
## Table 1. Container Images
1212

1313
This table provides the fully qualified container-image names for the components of SAS Viya Monitoring for Kubernetes.
14-
These names use the following format:
14+
These names use the following format:
1515
registry/repository/image_name:version
1616

1717
| Subsystem| Component | Fully Qualified Container-Image Name (registry/repository/image_name:version)|
1818
|----|----|----|
19-
| Logging | Fluent Bit | __FB_FULL_IMAGE__ |
20-
| Logging | Elasticsearch Exporter | __ES_EXPORTER_FULL_IMAGE__ |
19+
| Logging | [Fluent Bit](https://github.com/fluent/fluent-bit) | __FB_FULL_IMAGE__ |
20+
| Logging | [Elasticsearch Exporter](https://github.com/prometheus-community/elasticsearch_exporter) | __ES_EXPORTER_FULL_IMAGE__ |
2121
| Logging | initContainer (Fluent Bit, OpenSearch) | __OS_SYSCTL_FULL_IMAGE__ |
22-
| Logging | OpenSearch | __OS_FULL_IMAGE__ |
23-
| Logging | OpenSearch Dashboards| __OSD_FULL_IMAGE__ |
24-
| Metrics | Alertmanager | __ALERTMANAGER_FULL_IMAGE__ |
25-
| Metrics | Grafana | __GRAFANA_FULL_IMAGE__ |
26-
| Metrics | Admission Webhook | __ADMWEBHOOK_FULL_IMAGE__ |
27-
| Metrics | Kube State Metrics | __KSM_FULL_IMAGE__ |
28-
| Metrics | Node Exporter | __NODEXPORT_FULL_IMAGE__ |
29-
| Metrics | Prometheus | __PROMETHEUS_FULL_IMAGE__ |
30-
| Metrics | Prometheus Operator | __PROMOP_FULL_IMAGE__ |
31-
| Metrics | Configuration Reloader (Alertmanager, Prometheus) | __CONFIGRELOAD_FULL_IMAGE__ |
32-
| Metrics | Prometheus Pushgateway | __PUSHGATEWAY_FULL_IMAGE__ |
33-
| Metrics | Auto-load Sidecars (Grafana) | __GRAFANA_SIDECAR_FULL_IMAGE__ |
22+
| Logging | [OpenSearch](https://github.com/opensearch-project/OpenSearch) | __OS_FULL_IMAGE__ |
23+
| Logging | [OpenSearch Dashboards](https://github.com/opensearch-project/OpenSearch-Dashboards) | __OSD_FULL_IMAGE__ |
24+
| Metrics | [Alertmanager](https://github.com/prometheus/alertmanager) | __ALERTMANAGER_FULL_IMAGE__ |
25+
| Metrics | [Grafana](https://github.com/grafana/grafana) | __GRAFANA_FULL_IMAGE__ |
26+
| Metrics | [Admission Webhook](https://github.com/kubernetes/ingress-nginx) | __ADMWEBHOOK_FULL_IMAGE__ |
27+
| Metrics | [Kube State Metrics](https://github.com/kubernetes/kube-state-metrics) | __KSM_FULL_IMAGE__ |
28+
| Metrics | [Node Exporter](https://github.com/prometheus/node_exporter) | __NODEXPORT_FULL_IMAGE__ |
29+
| Metrics | [Prometheus](https://github.com/prometheus/prometheus) | __PROMETHEUS_FULL_IMAGE__ |
30+
| Metrics | [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator) | __PROMOP_FULL_IMAGE__ |
31+
| Metrics | [Configuration Reloader](https://github.com/jimmidyson/configmap-reload) | __CONFIGRELOAD_FULL_IMAGE__ |
32+
| Metrics | [Prometheus Pushgateway](https://github.com/prometheus/pushgateway) | __PUSHGATEWAY_FULL_IMAGE__ |
33+
| Metrics | [Auto-load Sidecars](https://github.com/kiwigrid/k8s-sidecar) | __GRAFANA_SIDECAR_FULL_IMAGE__ |
3434
| Metrics | OpenShift OAUTH Proxy (Grafana, OpenShift only) | __OPENSHIFT_OAUTHPROXY_FULL_IMAGE__ |
35-
| Metrics | Tempo | __TEMPO_FULL_IMAGE__ |
35+
| Metrics | [Tempo](https://github.com/grafana/tempo) | __TEMPO_FULL_IMAGE__ |
3636

3737
## Table 2. Helm Chart Repositories
3838
This table identifies the Helm repositories that contain the Helm charts used by SAS Viya Monitoring for Kubernetes.
3939
These repositories must be made available to Helm in your environment. Use the `helm repo add` command.
4040

4141
| Subsystem | Component | Helm Repository | Helm Repository URL |
4242
|--|--|--|--|
43-
| Logging | Fluent Bit | fluent | https://fluent.github.io/helm-charts |
44-
| Logging | OpenSearch and OpenSearch Dashboards | opensearch | https://opensearch-project.github.io/helm-charts |
45-
| Metrics | Grafana | grafana | https://grafana.github.io/helm-charts |
46-
| Both | Several (including Prometheus, Kube Prometheus Stack, Prometheus Pushgateway and Elasticsearch Exporter) | prometheus-community | https://prometheus-community.github.io/helm-charts |
43+
| Logging | [Fluent Bit](https://github.com/fluent/helm-charts) | fluent | https://fluent.github.io/helm-charts |
44+
| Logging | [OpenSearch and OpenSearch Dashboards](https://github.com/opensearch-project/helm-charts) | opensearch | https://opensearch-project.github.io/helm-charts |
45+
| Metrics | [Grafana](https://github.com/grafana/helm-charts) | grafana | https://grafana.github.io/helm-charts |
46+
| Both | [Prometheus Community](https://github.com/prometheus-community/helm-charts) | prometheus-community | https://prometheus-community.github.io/helm-charts |
4747

4848
## Table 3. Helm Chart Information
4949
This table identifies the Helm charts used by SAS Viya Monitoring for Kubernetes.
5050

5151
| Subsystem | Component | Helm Chart Repository | Helm Chart Name |Helm Chart Version | Helm Archive File Name|
5252
|--|--|--|--|--|--|
53-
| Logging | Elasticsearch Exporter| __ESEXPORTER_HELM_CHART_REPO__ | __ESEXPORTER_HELM_CHART_NAME__ | __ESEXPORTER_HELM_CHART_VERSION__ | __ESEXPORTER_HELM_CHART_ARCHIVE__ |
54-
| Logging | Fluent Bit| __FLUENTBIT_HELM_CHART_REPO__ | __FLUENTBIT_HELM_CHART_NAME__ | __FLUENTBIT_HELM_CHART_VERSION__ | __FLUENTBIT_HELM_CHART_ARCHIVE__ |
55-
| Logging | OpenSearch| __OPENSEARCH_HELM_CHART_REPO__ | __OPENSEARCH_HELM_CHART_NAME__ | __OPENSEARCH_HELM_CHART_VERSION__ | __OPENSEARCH_HELM_CHART_ARCHIVE__ |
56-
| Logging | OpenSearch Dashboard| __OSD_HELM_CHART_REPO__ | __OSD_HELM_CHART_NAME__ | __OSD_HELM_CHART_VERSION__ | __OSD_HELM_CHART_ARCHIVE__ |
57-
| Metrics | Grafana (on OpenShift)| __OPENSHIFT_GRAFANA_CHART_REPO__ | __OPENSHIFT_GRAFANA_CHART_NAME__ | __OPENSHIFT_GRAFANA_CHART_VERSION__ | __OPENSHIFT_GRAFANA_CHART_ARCHIVE__ |
58-
| Metrics | Kube Prometheus Stack| __KUBE_PROM_STACK_CHART_REPO__ | __KUBE_PROM_STACK_CHART_NAME__ | __KUBE_PROM_STACK_CHART_VERSION__ | __KUBE_PROM_STACK_CHART_ARCHIVE__ |
59-
| Metrics | Prometheus Pushgateway| __PUSHGATEWAY_CHART_REPO__ | __PUSHGATEWAY_CHART_NAME__ | __PUSHGATEWAY_CHART_VERSION__ | __PUSHGATEWAY_CHART_ARCHIVE__ |
60-
| Metrics | Tempo | __TEMPO_CHART_REPO__ | __TEMPO_CHART_NAME__ | __TEMPO_CHART_VERSION__ | __TEMPO_CHART_ARCHIVE__ |
53+
| Logging | [Elasticsearch Exporter](https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus-elasticsearch-exporter)| __ESEXPORTER_HELM_CHART_REPO__ | __ESEXPORTER_HELM_CHART_NAME__ | __ESEXPORTER_HELM_CHART_VERSION__ | __ESEXPORTER_HELM_CHART_ARCHIVE__ |
54+
| Logging | [Fluent Bit](https://github.com/fluent/helm-charts/tree/main/charts/fluent-bit)| __FLUENTBIT_HELM_CHART_REPO__ | __FLUENTBIT_HELM_CHART_NAME__ | __FLUENTBIT_HELM_CHART_VERSION__ | __FLUENTBIT_HELM_CHART_ARCHIVE__ |
55+
| Logging | [OpenSearch](https://github.com/opensearch-project/helm-charts/tree/main/charts/opensearch)| __OPENSEARCH_HELM_CHART_REPO__ | __OPENSEARCH_HELM_CHART_NAME__ | __OPENSEARCH_HELM_CHART_VERSION__ | __OPENSEARCH_HELM_CHART_ARCHIVE__ |
56+
| Logging | [OpenSearch Dashboards](https://github.com/opensearch-project/helm-charts/tree/main/charts/opensearch-dashboards)| __OSD_HELM_CHART_REPO__ | __OSD_HELM_CHART_NAME__ | __OSD_HELM_CHART_VERSION__ | __OSD_HELM_CHART_ARCHIVE__ |
57+
| Metrics | [Grafana (on OpenShift)](https://github.com/grafana/helm-charts/tree/main/charts/grafana)| __OPENSHIFT_GRAFANA_CHART_REPO__ | __OPENSHIFT_GRAFANA_CHART_NAME__ | __OPENSHIFT_GRAFANA_CHART_VERSION__ | __OPENSHIFT_GRAFANA_CHART_ARCHIVE__ |
58+
| Metrics | [Kube Prometheus Stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack)| __KUBE_PROM_STACK_CHART_REPO__ | __KUBE_PROM_STACK_CHART_NAME__ | __KUBE_PROM_STACK_CHART_VERSION__ | __KUBE_PROM_STACK_CHART_ARCHIVE__ |
59+
| Metrics | [Prometheus Pushgateway](https://github.com/prometheus-community/helm-charts/tree/main/charts/prometheus-pushgateway)| __PUSHGATEWAY_CHART_REPO__ | __PUSHGATEWAY_CHART_NAME__ | __PUSHGATEWAY_CHART_VERSION__ | __PUSHGATEWAY_CHART_ARCHIVE__ |
60+
| Metrics | [Tempo](https://github.com/grafana/helm-charts/tree/main/charts/tempo)| __TEMPO_CHART_REPO__ | __TEMPO_CHART_NAME__ | __TEMPO_CHART_VERSION__ | __TEMPO_CHART_ARCHIVE__ |
6161

6262
## Table 4. Miscellaneous Component Version Information
6363
This table provides version information for some miscellaneous components deployed by SAS Viya Monitoring for Kubernetes.
6464

6565
| Component | Version | Project Repository | Notes |
6666
|--|--|--|--|
6767
| OpenSearch Datasource Plugin (Grafana) | __GRAFANA_DATASOURCE_PLUGIN_VERSION__ | https://github.com/grafana/opensearch-datasource/releases |Allows Grafana to surface log messages stored in OpenSearch |
68-

SECURITY.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# SAS® Viya® Monitoring for Kubernetes Security Policy
2+
3+
The project maintainers and community contributors take security issues seriously. We appreciate efforts to disclose potential issues responsibly and will acknowledge viable contributions. To aid in the investigation of reported vulnerabilities, please follow the [reporting guidelines](#reporting-guidelines) outlined below.
4+
5+
## Scope of Security Reports
6+
7+
### In Scope
8+
The following components are directly maintained by this project and should be reported through our security reporting process:
9+
10+
* Custom deployment scripts and automation code
11+
* Project-specific configuration files and templates
12+
* Custom Kubernetes manifests and Helm charts
13+
* Project documentation and guidance
14+
* Any other artifacts created and maintained specifically by the SAS Viya Monitoring for Kubernetes project
15+
16+
### Out of Scope
17+
This project deploys and configures various third-party open-source monitoring tools. For a complete inventory of third-party components used by this project, please refer to [ARTIFACT_INVENTORY.md](ARTIFACT_INVENTORY.md).
18+
19+
Vulnerabilities in these underlying components should be reported to their respective projects. For example:
20+
21+
* Grafana - Report via [Grafana Security](https://github.com/grafana/grafana/security)
22+
* Prometheus - Report via [Prometheus Security](https://github.com/prometheus/prometheus/security)
23+
* OpenSearch - Report via [OpenSearch Security](https://github.com/opensearch-project/OpenSearch/security)
24+
25+
Vulnerabilities identified through container image scanning should be reported directly to the project that maintains the container image. For example, if a scan of the OpenSearch container image reveals vulnerabilities, these should be reported to the OpenSearch project, not to SAS Viya Monitoring for Kubernetes.
26+
27+
If you're unsure whether a vulnerability belongs to our project's code or an underlying component, please submit the report through our process and we will help direct it to the appropriate team.
28+
29+
## Reporting Guidelines
30+
31+
To report a suspected security issue that is in scope for this project, use GitHub's private vulnerability reporting:
32+
33+
1. Click the `Security` tab
34+
2. Click the `Report a vulnerability` button
35+
36+
Please provide the following information with your security report:
37+
38+
* Your name and affiliation (if applicable)
39+
* Version/build-date of the SAS Viya Monitoring for Kubernetes project
40+
* Detailed description of the security issue
41+
* Steps to reproduce the issue
42+
* Impact of the vulnerability
43+
* Any known public information about this vulnerability (e.g., related CVE, security advisory)
44+
* Whether the vulnerability exists in the latest version
45+
* Suggested fixes or mitigations (if any)
46+
47+
## Recognition
48+
49+
Contributors who responsibly disclose security vulnerabilities will be acknowledged in our release notes (unless they prefer to remain anonymous).
50+
51+
## Additional Information
52+
53+
For general questions about the project's security, please open a regular GitHub issue. Do not include sensitive security-related details in public issues.
54+
55+
Note: This security policy may be updated from time to time. Please refer to the latest version in the repository.

0 commit comments

Comments
 (0)