From 30065b494d096ce821ae6de152b89da8706c42ba Mon Sep 17 00:00:00 2001 From: Agil Antony Date: Thu, 6 Aug 2026 16:57:03 +0530 Subject: [PATCH] ROX33164 Fix DITA errors in architecture/acs-architecture.adoc --- architecture/acs-architecture.adoc | 50 ++++++++++++++- cloud_service/acscs-architecture.adoc | 39 +++++++++++ .../acs-architecture-external-components.adoc | 2 +- ...itecture-interaction-between-services.adoc | 4 +- ...acs-secured-cluster-services-overview.adoc | 8 ++- modules/con-vuln-sources.adoc | 64 +------------------ modules/scanner-v4-vuln-sources.adoc | 48 ++++++++++++++ modules/stackrox-scanner-vuln-sources.adoc | 26 ++++++++ 8 files changed, 171 insertions(+), 70 deletions(-) create mode 100644 modules/scanner-v4-vuln-sources.adoc create mode 100644 modules/stackrox-scanner-vuln-sources.adoc diff --git a/architecture/acs-architecture.adoc b/architecture/acs-architecture.adoc index 3215389b82c..cd546015fc8 100644 --- a/architecture/acs-architecture.adoc +++ b/architecture/acs-architecture.adoc @@ -9,6 +9,7 @@ toc::[] [role="_abstract"] Discover {rh-rhacs-first} architecture and concepts. +//{product-title} architecture overview include::modules/acs-architecture-overview.adoc[leveloffset=+1] [role="_additional-resources"] @@ -16,19 +17,64 @@ include::modules/acs-architecture-overview.adoc[leveloffset=+1] * xref:../architecture/acs-architecture.adoc#external-components_acs-architecture[External components] * xref:../operating/examine-images-for-vulnerabilities.adoc#scanner-v4-enabling[Enabling Scanner V4] +//Central services include::modules/acs-central-services-overview.adoc[leveloffset=+1] +//Vulnerability data sources include::modules/con-vuln-sources.adoc[leveloffset=+2] +//Scanner V4 sources +include::modules/scanner-v4-vuln-sources.adoc[leveloffset=+3] + +[role="_additional-resources"] +.Additional resources +* link:https://security.access.redhat.com/data/csaf/v2/vex/[Red{nbsp}Hat VEX] +* link:https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex[Vulnerability Exploitability eXchange (VEX)] +* link:https://access.redhat.com/security/middleware_security_scanning_problem[Accurate security data for Middleware products] +* link:https://www.redhat.com/en/blog/future-red-hat-security-data[The future of Red{nbsp}Hat security data] +* link:https://osv.dev/[OSV] +* link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0] +* link:https://nvd.nist.gov/[NVD] +* link:https://secdb.alpinelinux.org/[Alpine Security Database] +* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center] +* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker] +* link:https://linux.oracle.com/security/oval[Oracle OVAL] +* link:https://packages.vmware.com/photon/photon_oval_definitions/[Photon OVAL] +* link:https://support.novell.com/security/oval/[SUSE OVAL] +* link:https://security-metadata.canonical.com/oval/[Ubuntu OVAL] +* link:https://github.com/stackrox/stackrox/blob/master/scanner/updater/manual/vulns.go[StackRox vulnerability data] +* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json] +* link:https://security.access.redhat.com/data/metrics/container-name-repos-map.json[container-name-repos-map.json] + +//StackRox Scanner sources +include::modules/stackrox-scanner-vuln-sources.adoc[leveloffset=+3] + +[role="_additional-resources"] +.Additional resources +* link:https://access.redhat.com/security/data/oval/v2/[Red{nbsp}Hat OVAL v2] +* link:https://secdb.alpinelinux.org/[Alpine Security Database] +* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center] +* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker] +* link:https://git.launchpad.net/ubuntu-cve-tracker/[Ubuntu CVE Tracker] +* link:https://nvd.nist.gov/[NVD] +* link:https://github.com/stackrox/scanner/blob/master/ext/vulnsrc/manual/manual.go[Linux manual entries] +* link:https://github.com/stackrox/scanner/blob/master/pkg/vulnloader/nvdloader/manual.go[NVD manual entries] +* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json] + +//Secured cluster services include::modules/acs-secured-cluster-services-overview.adoc[leveloffset=+1] +//External components include::modules/acs-architecture-external-components.adoc[leveloffset=+1] +//Interaction between the services include::modules/acs-architecture-interaction-between-services.adoc[leveloffset=+1] +//{product-title-short} connection protocols and default ports include::modules/acs-architecture-connections.adoc[leveloffset=+1] [role="_additional-resources"] -.Additional resources -* xref:../installing/installing_ocp/install-central-ocp.html#install-central-operator-external-db_install-central-ocp[Installing Central with an external database using the Operator method] +[id="additional-resources_acs-architecture"] +== Additional resources +* xref:../installing/installing_ocp/install-central-ocp.adoc#install-central-operator-external-db_install-central-ocp[Installing Central with an external database using the Operator method] * xref:../cli/command-reference/roxctl.adoc#roxctl-command-options_roxctl[roxctl command options] \ No newline at end of file diff --git a/cloud_service/acscs-architecture.adoc b/cloud_service/acscs-architecture.adoc index ae3bf876b95..ab85508e144 100644 --- a/cloud_service/acscs-architecture.adoc +++ b/cloud_service/acscs-architecture.adoc @@ -16,8 +16,47 @@ include::modules/acscs-architecture-overview.adoc[leveloffset=+1] include::modules/acscs-central-overview.adoc[leveloffset=+1] +//Vulnerability data sources include::modules/con-vuln-sources.adoc[leveloffset=+2] +//Scanner V4 sources +include::modules/scanner-v4-vuln-sources.adoc[leveloffset=+3] + +[role="_additional-resources"] +.Additional resources +* link:https://security.access.redhat.com/data/csaf/v2/vex/[Red{nbsp}Hat VEX] +* link:https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex[Vulnerability Exploitability eXchange (VEX)] +* link:https://access.redhat.com/security/middleware_security_scanning_problem[Accurate security data for Middleware products] +* link:https://www.redhat.com/en/blog/future-red-hat-security-data[The future of Red{nbsp}Hat security data] +* link:https://osv.dev/[OSV] +* link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0] +* link:https://nvd.nist.gov/[NVD] +* link:https://secdb.alpinelinux.org/[Alpine Security Database] +* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center] +* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker] +* link:https://linux.oracle.com/security/oval[Oracle OVAL] +* link:https://packages.vmware.com/photon/photon_oval_definitions/[Photon OVAL] +* link:https://support.novell.com/security/oval/[SUSE OVAL] +* link:https://security-metadata.canonical.com/oval/[Ubuntu OVAL] +* link:https://github.com/stackrox/stackrox/blob/master/scanner/updater/manual/vulns.go[StackRox vulnerability data] +* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json] +* link:https://security.access.redhat.com/data/metrics/container-name-repos-map.json[container-name-repos-map.json] + +//StackRox Scanner sources +include::modules/stackrox-scanner-vuln-sources.adoc[leveloffset=+3] + +[role="_additional-resources"] +.Additional resources +* link:https://access.redhat.com/security/data/oval/v2/[Red{nbsp}Hat OVAL v2] +* link:https://secdb.alpinelinux.org/[Alpine Security Database] +* link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center] +* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker] +* link:https://git.launchpad.net/ubuntu-cve-tracker/[Ubuntu CVE Tracker] +* link:https://nvd.nist.gov/[NVD] +* link:https://github.com/stackrox/scanner/blob/master/ext/vulnsrc/manual/manual.go[Linux manual entries] +* link:https://github.com/stackrox/scanner/blob/master/pkg/vulnloader/nvdloader/manual.go[NVD manual entries] +* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json] + include::modules/acs-secured-cluster-services-overview.adoc[leveloffset=+1] [role="_additional-resources"] diff --git a/modules/acs-architecture-external-components.adoc b/modules/acs-architecture-external-components.adoc index 9e17348892c..66e45ce2bf8 100644 --- a/modules/acs-architecture-external-components.adoc +++ b/modules/acs-architecture-external-components.adoc @@ -6,7 +6,7 @@ = External components [role="_abstract"] -{product-title} ({product-title-short}) interacts with different external components to provide additional features and functionality, such as CLI access to the system, access to image registries, data from vulnerability feeds, and integrations with third-party systems. +{product-title} ({product-title-short}) interacts with different external components to provide additional features and functionality, such as CLI access to the system, access to image registries, data from vulnerability feeds, and integrations with third-party systems. {product-title-short} interacts with the following external components: diff --git a/modules/acs-architecture-interaction-between-services.adoc b/modules/acs-architecture-interaction-between-services.adoc index 1823a67f429..0e471364b24 100644 --- a/modules/acs-architecture-interaction-between-services.adoc +++ b/modules/acs-architecture-interaction-between-services.adoc @@ -60,7 +60,7 @@ Central communicates with Sensor to force reprocessing of all deployments agains |Collector |⮂ |Sensor -|Collector communicates with Sensor and sends all of the events to the respective Sensor for the cluster. +|Collector communicates with Sensor and sends all of the events to Sensor for the cluster. On supported {ocp} clusters, Collector analyzes the software packages installed on the nodes and sends them to Sensor so that Scanner can later scan them for vulnerabilities. Collector also requests missing drivers from Sensor. Sensor requests compliance scan results from Collector. Additionally, Sensor receives external Classless Inter-Domain Routing information from Central and pushes it to Collector. @@ -128,7 +128,7 @@ Central communicates with Sensor to force reprocessing of all deployments agains |Collector |⮂ |Sensor -|Collector communicates with Sensor and sends all of the events to the respective Sensor for the cluster. +|Collector communicates with Sensor and sends all of the events to Sensor for the cluster. On supported {ocp} clusters, Collector analyzes the software packages installed on the nodes and sends them to Sensor so that Scanner can later scan them for vulnerabilities. Collector also requests missing drivers from Sensor. Sensor requests compliance scan results from Collector. Additionally, Sensor receives external Classless Inter-Domain Routing information from Central and pushes it to Collector. diff --git a/modules/acs-secured-cluster-services-overview.adoc b/modules/acs-secured-cluster-services-overview.adoc index 7ac996df079..8cd15dbf1b8 100644 --- a/modules/acs-secured-cluster-services-overview.adoc +++ b/modules/acs-secured-cluster-services-overview.adoc @@ -1,9 +1,7 @@ // Module included in the following assemblies: // // * architecture/acs-architecture.adoc -:_mod-docs-content-type: CONCEPT -[id="acs-secured-cluster-services_{context}"] -= Secured cluster services +// * cloud_service/acscs-architecture.adoc ifeval::["{context}" == "acscs-architecture"] :title: Red Hat Advanced Cluster Security Cloud Service @@ -15,6 +13,10 @@ ifeval::["{context}" == "acs-architecture"] :short-title: RHACS endif::[] +:_mod-docs-content-type: CONCEPT +[id="acs-secured-cluster-services_{context}"] += Secured cluster services + [role="_abstract"] Install the secured cluster services on each cluster that you want to secure by using {title}. diff --git a/modules/con-vuln-sources.adoc b/modules/con-vuln-sources.adoc index 477d9025bce..f3c7920927c 100644 --- a/modules/con-vuln-sources.adoc +++ b/modules/con-vuln-sources.adoc @@ -6,70 +6,10 @@ [id="con-vuln-sources_{context}"] = Vulnerability data sources +[role="_abstract"] Sources for vulnerabilities depend on the scanner that is used in your system. {product-title-short} contains two scanners: StackRox Scanner and Scanner V4. The StackRox Scanner is deprecated. Scanner V4 is the default image scanner. -+ -[NOTE] -==== -Although the StackRox Scanner is deprecated, it still must be enabled on the cluster where Central is installed due to software dependencies. -==== - -[id="scanner-v4-vuln-sources"] -== Scanner V4 sources - -Scanner V4 uses the following vulnerability sources: - -link:https://security.access.redhat.com/data/csaf/v2/vex/[Red{nbsp}Hat VEX]:: This source is used with release 4.6 and later. This source provides vulnerability data in link:https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#45-profile-5-vex[Vulnerability Exploitability eXchange(VEX)] format. {product-title-short} takes advantage of VEX benefits to significantly decrease the time needed for the initial loading of vulnerability data, and the space needed to store vulnerability data. VEX also provides improved accuracy over OVAL. -+ -{product-title-short} might list a different number of vulnerabilities when you are scanning with a {product-title-short} version that uses OVAL, such as {product-title-short} version 4.5, and a version that uses VEX, such as version 4.6. For example, {product-title-short} no longer displays vulnerabilities with a status of "under investigation," while these vulnerabilities were included with previous versions that used OVAL data. -+ -For containers from or built on top of containers from the Red{nbsp}Hat Ecosystem Catalog, {product-title-short} provides an option to show only vulnerabilities from Red{nbsp}Hat's VEX data. VEX data for Red{nbsp}Hat images is the most accurate because the Red{nbsp}Hat security team vets the vulnerabilities in those images and reports the results in VEX. Other vulnerability sources such as OSV can report vulnerabilities that Red{nbsp}Hat has determined are not applicable to the image. This can cause false positives in vulnerability results. Enabling the setting to use only VEX data for Red{nbsp}Hat images minimizes these false positives. -+ -The option to use VEX data for Red{nbsp}Hat containers is disabled by default. To enable this option, in Scanner V4 Matcher, set the environment variable `ROX_SCANNER_V4_RED_HAT_LAYERS_RED_HAT_VULNS_ONLY` to `true`. Be aware that in rare instances, using this option can cause valid vulnerabilities to not appear in scan results, or false negatives. For example, Red{nbsp}Hat does not track vulnerabilities for products that have reached end of life. Also be aware that Red{nbsp}Hat's VEX data is missing link:https://access.redhat.com/security/middleware_security_scanning_problem[accurate security data for many Middleware products]. -+ -For more information about Red{nbsp}Hat security data, including information about the use of OVAL, Common Security Advisory Framework Version 2.0 (CSAF), and VEX, see link:https://www.redhat.com/en/blog/future-red-hat-security-data[The future of Red{nbsp}Hat security data]. -link:https://osv.dev/[OSV]:: This is used for language-related vulnerabilities, such as Go, Java, JavaScript, Python, and Ruby. This source might provide -vulnerability IDs other than CVE IDs for vulnerabilities, such as a GitHub Security Advisory (GHSA) ID. -+ -[NOTE] -==== -{product-title-short} uses the OSV database available at link:https://osv.dev/[OSV.dev] under link:https://github.com/google/osv.dev/blob/master/LICENSE[Apache License 2.0]. -==== -link:https://nvd.nist.gov/[NVD]:: This is used for various purposes such as filling in information gaps when vendors do not provide information. For example, Alpine does not provide a description, CVSS score, severity, or published date. -+ -[NOTE] -==== -This product uses the NVD API but is not endorsed or certified by the NVD. -==== -Additional vulnerability sources:: -* link:https://secdb.alpinelinux.org/[Alpine Security Database] -* Data tracked in link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center] -* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker] -* link:https://linux.oracle.com/security/oval[Oracle OVAL] -* link:https://packages.vmware.com/photon/photon_oval_definitions/[Photon OVAL] -* link:https://support.novell.com/security/oval/[SUSE OVAL] -* link:https://security-metadata.canonical.com/oval/[Ubuntu OVAL] -* link:https://github.com/stackrox/stackrox/blob/master/scanner/updater/manual/vulns.go[StackRox]: The upstream StackRox project maintains a set of vulnerabilities that might not be discovered due to data formatting from other sources or absence of data. - -Scanner V4 Indexer sources:: Scanner V4 indexer uses the following files to index Red{nbsp}Hat containers: -* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]: Maps RPM repositories to their related CPEs, which is required for matching vulnerabilities for RHEL-based images. -* link:https://security.access.redhat.com/data/metrics/container-name-repos-map.json[container-name-repos-map.json]: This matches container names to their respective repositories. - -[id="stackrox-scanner-vuln-sources"] -== StackRox Scanner sources - -StackRox Scanner uses the following vulnerability sources: - -* link:https://access.redhat.com/security/data/oval/v2/[Red{nbsp}Hat OVAL] v2 -* link:https://secdb.alpinelinux.org/[Alpine Security Database] -* Data tracked in link:https://alas.aws.amazon.com/index.html[Amazon Linux Security Center] -* link:https://security-tracker.debian.org/tracker/data/json[Debian Security Tracker] -* link:https://git.launchpad.net/ubuntu-cve-tracker/[Ubuntu CVE Tracker] -* link:https://nvd.nist.gov/[NVD]: This is used for various purposes such as filling in information gaps when vendors do not provide information. For example, Alpine does not provide a description, CVSS score, severity, or published date. -+ [NOTE] ==== -This product uses the NVD API but is not endorsed or certified by the NVD. +Although the StackRox Scanner is deprecated, it still must be enabled on the cluster where Central is installed due to software dependencies. ==== -* link:https://github.com/stackrox/scanner/blob/master/ext/vulnsrc/manual/manual.go[Linux manual entries] and link:https://github.com/stackrox/scanner/blob/master/pkg/vulnloader/nvdloader/manual.go[NVD manual entries]: The upstream StackRox project maintains a set of vulnerabilities that might not be discovered due to data formatting from other sources or absence of data. -* link:https://security.access.redhat.com/data/metrics/repository-to-cpe.json[repository-to-cpe.json]: Maps RPM repositories to their related CPEs, which is required for matching vulnerabilities for RHEL-based images. \ No newline at end of file diff --git a/modules/scanner-v4-vuln-sources.adoc b/modules/scanner-v4-vuln-sources.adoc new file mode 100644 index 00000000000..c200d94717a --- /dev/null +++ b/modules/scanner-v4-vuln-sources.adoc @@ -0,0 +1,48 @@ +// Module included in the following assemblies: +// +// * architecture/acs-architecture.adoc +// * cloud_service/acscs-architecture.adoc +:_mod-docs-content-type: REFERENCE +[id="scanner-v4-vuln-sources_{context}"] += Scanner V4 sources + +[role="_abstract"] +Scanner V4 uses vulnerability data from Red{nbsp}Hat VEX, OSV, NVD, and other distribution-specific sources to identify and report security vulnerabilities in container images. + +Scanner V4 uses the following vulnerability sources: + +Red{nbsp}Hat VEX:: This source is used with release 4.6 and later. This source provides vulnerability data in Vulnerability Exploitability eXchange (VEX) format. {product-title-short} takes advantage of VEX benefits to significantly decrease the time needed for the initial loading of vulnerability data, and the space needed to store vulnerability data. VEX also provides improved accuracy over OVAL. ++ +{product-title-short} might list a different number of vulnerabilities when you are scanning with a {product-title-short} version that uses OVAL, such as {product-title-short} version 4.5, and a version that uses VEX, such as version 4.6. For example, {product-title-short} no longer displays vulnerabilities with a status of "under investigation," while these vulnerabilities were included with previous versions that used OVAL data. ++ +For containers from or built on top of containers from the Red{nbsp}Hat Ecosystem Catalog, {product-title-short} provides an option to show only vulnerabilities from Red{nbsp}Hat's VEX data. VEX data for Red{nbsp}Hat images is the most accurate because the Red{nbsp}Hat security team vets the vulnerabilities in those images and reports the results in VEX. Other vulnerability sources such as OSV can report vulnerabilities that Red{nbsp}Hat has determined are not applicable to the image. This can cause false positives in vulnerability results. Enabling the setting to use only VEX data for Red{nbsp}Hat images minimizes these false positives. ++ +The option to use VEX data for Red{nbsp}Hat containers is disabled by default. To enable this option, in Scanner V4 Matcher, set the environment variable `ROX_SCANNER_V4_RED_HAT_LAYERS_RED_HAT_VULNS_ONLY` to `true`. Be aware that in rare instances, using this option can cause valid vulnerabilities to not appear in scan results, or false negatives. For example, Red{nbsp}Hat does not track vulnerabilities for products that have reached end of life. Also be aware that Red{nbsp}Hat's VEX data is missing accurate security data for many Middleware products. ++ +For more information about Red{nbsp}Hat security data, including information about the use of OVAL, Common Security Advisory Framework Version 2.0 (CSAF), and VEX, see "The future of Red{nbsp}Hat security data". +OSV:: This is used for language-related vulnerabilities, such as Go, Java, JavaScript, Python, and Ruby. This source might provide vulnerability IDs other than CVE IDs for vulnerabilities, such as a GitHub Security Advisory (GHSA) ID. ++ +[NOTE] +==== +{product-title-short} uses the OSV database available at OSV.dev under the Apache License 2.0. +==== +NVD:: This is used for various purposes such as filling in information gaps when vendors do not provide information. For example, Alpine does not provide a description, CVSS score, severity, or published date. ++ +[NOTE] +==== +This product uses the NVD API but is not endorsed or certified by the NVD. +==== +Additional vulnerability sources:: +* Alpine Security Database +* Data tracked in Amazon Linux Security Center +* Debian Security Tracker +* Oracle OVAL +* Photon OVAL +* SUSE OVAL +* Ubuntu OVAL +* StackRox: The upstream StackRox project maintains a set of vulnerabilities that might not be discovered due to data formatting from other sources or absence of data. + +Scanner V4 Indexer sources:: Scanner V4 indexer uses the following files to index Red{nbsp}Hat containers: + +* repository-to-cpe.json: Maps RPM repositories to their related CPEs, which is required for matching vulnerabilities for RHEL-based images. +* container-name-repos-map.json: This maps container names to their repositories. diff --git a/modules/stackrox-scanner-vuln-sources.adoc b/modules/stackrox-scanner-vuln-sources.adoc new file mode 100644 index 00000000000..a0d9ff2103e --- /dev/null +++ b/modules/stackrox-scanner-vuln-sources.adoc @@ -0,0 +1,26 @@ +// Module included in the following assemblies: +// +// * architecture/acs-architecture.adoc +// * cloud_service/acscs-architecture.adoc +:_mod-docs-content-type: REFERENCE +[id="stackrox-scanner-vuln-sources_{context}"] += StackRox Scanner sources + +[role="_abstract"] +StackRox Scanner uses vulnerability data from Red{nbsp}Hat OVAL, NVD, and other distribution-specific sources to identify and report security vulnerabilities in container images. + +StackRox Scanner uses the following vulnerability sources: + +* Red{nbsp}Hat OVAL v2 +* Alpine Security Database +* Data tracked in Amazon Linux Security Center +* Debian Security Tracker +* Ubuntu CVE Tracker +* NVD: This is used for various purposes such as filling in information gaps when vendors do not provide information. For example, Alpine does not provide a description, CVSS score, severity, or published date. ++ +[NOTE] +==== +This product uses the NVD API but is not endorsed or certified by the NVD. +==== +* Linux manual entries and NVD manual entries: The upstream StackRox project maintains a set of vulnerabilities that might not be discovered due to data formatting from other sources or absence of data. +* repository-to-cpe.json: Maps RPM repositories to their related CPEs, which is required for matching vulnerabilities for RHEL-based images.