public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update CVE scan docs per feedback

Browse Source
This commit is contained in:
Catherine Luse
2021-07-01 22:26:56 -07:00
parent 1e95df10b4
commit 0cba63909f
2 changed files with 5 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.6/en/pipelines/_index.md
+1 -1
View File
@@ -5,7 +5,7 @@ aliases:
- /rancher/v2.6/en/k8s-in-rancher/pipelines
---
> As of Rancher v2.5, Git-based deployment pipelines are now recommended to be handled with Rancher Continuous Delivery powered by [Fleet,]({{<baseurl>}}/rancher/v2.6/en/deploy-across-clusters/fleet) available in Cluster Explorer. Pipelines will receive limited to no security updates, and should be used only if migrating to Fleet is not feasible.
> As of Rancher v2.5, Git-based deployment pipelines are now recommended to be handled with Rancher Continuous Delivery powered by [Fleet,]({{<baseurl>}}/rancher/v2.6/en/deploy-across-clusters/fleet) available in Cluster Explorer. Pipelines will receive only critical CVE fixes. They should be used only if migrating to Fleet is not feasible.
Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users.
content/rancher/v2.6/en/security/cve-scans/_index.md
+4 -18
View File
@@ -14,7 +14,7 @@ The CVE scanning process, introduced in Rancher v2.6, reduces the patching cycle
# Scope
The CVE scan includes all images shipped with Rancher releases, which are listed in the `rancher-images.txt` file included with every release. This list includes all core Rancher components and features.
The CVE scan includes all images shipped with Rancher releases, which are listed in the `rancher-images.txt` file included with every release. This list includes all core Rancher components and features. The published list of CVEs covers the latest development version of Rancher v2.6 and the catalog charts for the Rancher version.
The `rancher-images-sources.txt` file also includes the images, along with an annotation indicating what Rancher feature uses the image.
@@ -22,7 +22,7 @@ The `rancher-images-sources.txt` file also includes the images, along with an an
Rancher images are scanned with [Trivy,](https://github.com/aquasecurity/trivy) tool from Aqua Security. Other image scanning tools may yield different results.
# Scan Results
# Reporting Scan Results
The CVE scan report lists any image containing a CVE that is ranked by our scanning tool with a rating of `HIGH` or above.
@@ -42,27 +42,13 @@ For each image listed in the scan report, the following information is listed:
As new CVEs are reported, or new images with high or critical severity CVEs are brought into the pipeline, the Rancher team is automatically alerted and triages each vulnerability.
Rancher addresses vulnerabilities differently depending on whether the image is mirrored from a community project or maintained by Rancher.
Rancher addresses vulnerabilities differently depending on whether the image is mirrored from a community project or maintained by Rancher. Depending on the context and the situation, the vulnerabilities will either be fixed, or will be noted as false positives, or will be noted as not able to be fixed.
Some Rancher features will not receive security updates, or will receive limited ones. For details, see [this section](#features-with-limited-security-updates)
### Images Mirrored from Community Projects
If the upstream project has addressed and released a fix, the images are upgraded when possible in future Rancher releases.
If the upstream project has not released a fix, an issue explaining the situation is created and tracked by Rancher's engineering team.
### Images Maintained by Rancher
CVEs for images maintained by Rancher fall into one of the following categories:
- **False-positive:** We document these results and provide an explanation.
- **Vulnerabilities that will not be fixed:** We document these results and provide an explanation.For example, we may decide not to fix vulnerabilities caused by an upstream project that is no longer maintained, or a vulnerability that has a low attack surface.
- **Vulnerabilities that can be fixed:** These results include vulnerabilities in Rancher projects or upstream packages that need to be updated, and that are within our ability to fix. They are addressed an released in the same way as any other issue within Rancher.
### Features with Limited Security Updates
The following features will receive limited or no security updates:
- Cluster Manager's Istio, which ended with upstream version 1.5, should no longer be used as it hit end-of-life on August 21 2020. We recommend using the newer versions of Istio from the Cluster Explorer. The images for Istio 1.5 should not be downloaded unless upgrading Istio is not feasible.
- Pipelines were deprecated as of Rancher v2.5 and should no longer be used. We recommend handling Git-based deployment pipelines with [Fleet.]({{<baseurl>}}/rancher/v2.6/en/deploy-across-clusters/fleet)
- Pipelines were deprecated as of Rancher v2.5 and should no longer be used. The pipelines feature will receive only critical CVE fixes. We recommend handling Git-based deployment pipelines with [Fleet.]({{<baseurl>}}/rancher/v2.6/en/deploy-across-clusters/fleet)