[KEP-3203] Fetch and Render CVE JSON Feed #35228

PushkarJ · 2022-07-21T19:01:30Z

Description

Pull JSON blob from queried issues
Use layout output formats + templates to generate HTML table and JSON blob
Add localized strings and caption for CVE feed
Add a new page to describe details about CVE feed and how to use it
Update existing pages and link the official CVE feed from it

Notes for Reviewers

Why are we regenerating JSON blob from the JSON blob in the bucket ?

Not all fields stored in the bucket are needed
JSON download directly to a file with Hugo data templates is not possible
Gives us better control and ability to add extra fields as needed
Pulling data through hugo data templates allow us to reuse built-in caching mechanisms

Why not version control the JSON blob?

To avoid multiple sources of truth. The content in the bucket will remain the only source of truth as the JSON blob is constructed from GitHub issues with label official-cve-feed (See this for more info: kubernetes/test-infra#23428). However, as a break glass, there is an option to temporarily push the JSON blob by overriding the layouts json file with raw JSON in cases where push to bucket fails or if bucket is inaccessible.

Are the locations for the layouts files correct?

Current locations are mostly my guess, so happy to refactor them as needed

TODO:

Update JSON blob location to k8s GCS bucket
Add more description in the PR
Address PR feedback from superseded PR

Preview: https://deploy-preview-35228--kubernetes-io-main-staging.netlify.app/docs/reference/issues-security/official-cve-feed/
KEP tracker: kubernetes/enhancements#3203
xref: kubernetes/sig-security#1
supersedes #31051 and #34765
/hold
/sig security docs

netlify · 2022-07-21T19:14:14Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`b1e8d8e`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/62d9a28cdb345e00093a058a
😎 Deploy Preview	https://deploy-preview-35228--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

netlify · 2022-07-21T19:25:15Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`cafe6d2`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/62e953f31034230008c457f9
😎 Deploy Preview	https://deploy-preview-35228--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

layouts/shortcodes/issues-security.html

sftim

Paths within static that are actually generated should include generated in their path. A find and grep should show some existing paths that follow that convention.
I'd name gen-cve-feed.sh as fetch-cve-feed.sh

❓ How do we make sure that people don't accidentally commit that fetched file?

❓ For a container build, shouldn't the fetch happen inside the container?

Makefile

layouts/shortcodes/issues-security.html

layouts/shortcodes/cve-feed.html

layouts/_default/cve-feed.json

sftim · 2022-08-01T17:54:12Z

Rendered page LGTM

sftim · 2022-08-02T11:26:01Z

Should this PR target the dev-1.25 branch?

(I'm not sure - do we want to add the feed with the v1.25 release, or perhaps actually combine the blog announcement for the new feed with the switch-on)

We have options, and several of them are good. I want to be clear on which option we're picking so I can based my approval decision on that context.

- Pull JSON blob from queried issues - Use layout output formats + templates to generate HTML table and JSON blob - Add localized strings and caption for CVE feed - Add a new page to describe details about CVE feed and how to use it - Update existing pages and link the official CVE feed from it Co-authored-by: Neha Lohia <[email protected]> Co-authored-by: Tim Bannister <[email protected]>

PushkarJ · 2022-08-02T16:44:23Z

@sftim I think the #35608 blog being published along with the CVE feed being available by v1.25 sounds like a good idea to me. I have switched target branch to dev-1.25 now.

sftim · 2022-08-03T09:01:44Z

@sftim I think the #35608 blog being published along with the CVE feed being available by v1.25 sounds like a good idea to me

I'm not sure I understand. Which of these is right:

the feed goes live on v1.25 release day
the feed goes live after v1.25 release day, simultaneous with the blog announcement about the new feed going live
something else!

?

PushkarJ · 2022-08-03T16:27:44Z

What I meant was, the feed goes live on v1.25 release day, the feature blog is followed soon after (in next few days). This will allow the feed to have some soak time to iron out any issues we find after going live :)

sftim · 2022-08-03T20:54:52Z

What I meant was, the feed goes live on v1.25 release day, the feature blog is followed soon after (in next few days). This will allow the feed to have some soak time to iron out any issues we find after going live :)

Sounds good to me.

/approve
/remove-label tide/merge-method-squash

sftim · 2022-08-03T20:55:14Z

(I'd like somebody else to add the LGTM here)

k8s-ci-robot · 2022-08-03T20:55:16Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nehaLohia27, sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

PushkarJ · 2022-08-03T22:05:31Z

/cc @nehaLohia27 @savitharaghunathan

(Tagging you both for /lgtm and/or review comments)

reylejano · 2022-08-03T22:24:31Z

/milestone 1.25
/assign @kcmartin

reylejano · 2022-08-08T18:59:04Z

/lgtm

k8s-ci-robot · 2022-08-08T18:59:24Z

LGTM label has been added.

Git tree hash: 7581df102046b8f3ddd1be864ad4b2ad7561bd2b

katcosgrove · 2022-08-15T13:40:41Z

Hi from the Comms team! We have you tracked for a feature blog, but the link provided to us was a KEP, not a placeholder blog PR. Are you still intending to have a feature blog for this release?

sftim · 2022-08-15T13:47:06Z

Announcement blog article will be added via #35608

k8s-ci-robot requested a review from daminisatya July 21, 2022 19:02

k8s-ci-robot added the language/en Issues or PRs related to English language label Jul 21, 2022

k8s-ci-robot requested a review from mehabhalodiya July 21, 2022 19:02

PushkarJ force-pushed the kep-3203-k-website-updates branch from b1e8d8e to 6356d72 Compare July 21, 2022 19:04

PushkarJ changed the title ~~[KEP-3203] Fetch and Render CVE JSON feed~~ [KEP-3203] [WIP - Very Early to Review] Fetch and Render CVE JSON feed Jul 21, 2022

PushkarJ changed the title ~~[KEP-3203] [WIP - Very Early to Review] Fetch and Render CVE JSON feed~~ [KEP-3203] [WIP - Not Ready to Review] Fetch and Render CVE JSON feed Jul 21, 2022

PushkarJ force-pushed the kep-3203-k-website-updates branch from 6356d72 to 566edee Compare July 21, 2022 19:09

PushkarJ marked this pull request as ready for review July 21, 2022 19:13

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 21, 2022

k8s-ci-robot requested a review from kbhawkey July 21, 2022 19:14

PushkarJ force-pushed the kep-3203-k-website-updates branch from 566edee to c8d8ba1 Compare July 21, 2022 19:21

PushkarJ force-pushed the kep-3203-k-website-updates branch 2 times, most recently from ea22fca to 2a2fdcc Compare July 21, 2022 20:48

PushkarJ mentioned this pull request Jul 21, 2022

generate cve issues table using hugo #31051

Closed

PushkarJ force-pushed the kep-3203-k-website-updates branch from 2a2fdcc to 5acbad1 Compare July 21, 2022 21:10

PushkarJ changed the title ~~[KEP-3203] [WIP - Not Ready to Review] Fetch and Render CVE JSON feed~~ [KEP-3203] Fetch and Render CVE JSON feed Jul 21, 2022

PushkarJ mentioned this pull request Jul 21, 2022

Create a periodically auto-refreshing list of fixed CVEs kubernetes/sig-security#1

Open

12 tasks

sftim reviewed Jul 22, 2022

View reviewed changes

layouts/shortcodes/issues-security.html Outdated Show resolved Hide resolved

sftim reviewed Jul 22, 2022

View reviewed changes

sftim reviewed Jul 24, 2022

View reviewed changes

Makefile Outdated Show resolved Hide resolved

sftim reviewed Jul 24, 2022

View reviewed changes

layouts/shortcodes/issues-security.html Outdated Show resolved Hide resolved

sftim reviewed Jul 24, 2022

View reviewed changes

layouts/shortcodes/issues-security.html Outdated Show resolved Hide resolved

layouts/shortcodes/issues-security.html Outdated Show resolved Hide resolved

PushkarJ commented Aug 1, 2022

View reviewed changes

layouts/shortcodes/cve-feed.html Show resolved Hide resolved

PushkarJ commented Aug 1, 2022

View reviewed changes

layouts/_default/cve-feed.json Show resolved Hide resolved

PushkarJ force-pushed the kep-3203-k-website-updates branch from 3d6f130 to 099ebeb Compare August 1, 2022 18:45

PushkarJ force-pushed the kep-3203-k-website-updates branch from 099ebeb to cafe6d2 Compare August 2, 2022 16:42

PushkarJ changed the base branch from main to dev-1.25 August 2, 2022 16:42

k8s-ci-robot removed the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Aug 3, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 3, 2022

k8s-ci-robot requested review from nehaLohia27 and savitharaghunathan August 3, 2022 22:05

k8s-ci-robot assigned kcmartin Aug 3, 2022

k8s-ci-robot added this to the 1.25 milestone Aug 3, 2022

PushkarJ mentioned this pull request Aug 5, 2022

Placeholder for KEP-3203 docs #34765

Closed

k8s-ci-robot assigned reylejano Aug 8, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 8, 2022

k8s-ci-robot merged commit c465685 into kubernetes:dev-1.25 Aug 8, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[KEP-3203] Fetch and Render CVE JSON Feed #35228

[KEP-3203] Fetch and Render CVE JSON Feed #35228

PushkarJ commented Jul 21, 2022 •

edited

Loading

netlify bot commented Jul 21, 2022

netlify bot commented Jul 21, 2022 •

edited

Loading

sftim left a comment

sftim commented Aug 1, 2022

sftim commented Aug 2, 2022

PushkarJ commented Aug 2, 2022

sftim commented Aug 3, 2022

PushkarJ commented Aug 3, 2022

sftim commented Aug 3, 2022

sftim commented Aug 3, 2022

k8s-ci-robot commented Aug 3, 2022

PushkarJ commented Aug 3, 2022

reylejano commented Aug 3, 2022

reylejano commented Aug 8, 2022

k8s-ci-robot commented Aug 8, 2022

katcosgrove commented Aug 15, 2022

sftim commented Aug 15, 2022

[KEP-3203] Fetch and Render CVE JSON Feed #35228

[KEP-3203] Fetch and Render CVE JSON Feed #35228

Conversation

PushkarJ commented Jul 21, 2022 • edited Loading

Description

Notes for Reviewers

Why are we regenerating JSON blob from the JSON blob in the bucket ?

Why not version control the JSON blob?

Are the locations for the layouts files correct?

netlify bot commented Jul 21, 2022

✅ Pull request preview available for checking

netlify bot commented Jul 21, 2022 • edited Loading

✅ Pull request preview available for checking

sftim left a comment

Choose a reason for hiding this comment

sftim commented Aug 1, 2022

sftim commented Aug 2, 2022

PushkarJ commented Aug 2, 2022

sftim commented Aug 3, 2022

PushkarJ commented Aug 3, 2022

sftim commented Aug 3, 2022

sftim commented Aug 3, 2022

k8s-ci-robot commented Aug 3, 2022

PushkarJ commented Aug 3, 2022

reylejano commented Aug 3, 2022

reylejano commented Aug 8, 2022

k8s-ci-robot commented Aug 8, 2022

katcosgrove commented Aug 15, 2022

sftim commented Aug 15, 2022

PushkarJ commented Jul 21, 2022 •

edited

Loading

netlify bot commented Jul 21, 2022 •

edited

Loading