Skip to main content

Security Advisories

Purpose: For security officers, provides published security advisories, CVE tracking, and patching timelines.

Overview​

openCenter tracks security vulnerabilities across all platform components — Kubernetes, Helm charts, container images, and infrastructure dependencies. This document describes how CVEs are identified, assessed, patched, and communicated.

CVE Tracking​

Vulnerabilities are tracked from three sources:

SourceScopeFrequency
Kubernetes security announcementsKubernetes core, kubelet, API serverAs published
GitHub Dependabot / Advisory DBGo modules, Helm charts, container base imagesContinuous
Harbor Trivy scannerAll container images in the platform registryOn push + scheduled

Severity Classification​

openCenter follows the CVSS v3.1 scoring system:

CVSS ScoreSeverityResponse Target
9.0–10.0CriticalPatch within 72 hours
7.0–8.9HighPatch within 7 days
4.0–6.9MediumPatch in next scheduled release
0.1–3.9LowPatch at maintainer discretion

Patching Process​

Platform Components (openCenter-gitops-base)​

  1. The vulnerability is identified in a Helm chart or container image
  2. The updated chart version or image tag is tested in a staging cluster
  3. The base manifest in openCenter-gitops-base is updated with the patched version
  4. A new tag is created on openCenter-gitops-base
  5. Customer clusters pin to the new tag in their GitRepository source
  6. FluxCD reconciles the update to the cluster

Kubernetes Core​

  1. Kubespray is updated to reference the patched Kubernetes version
  2. The cluster is upgraded using the standard Kubespray upgrade playbook
  3. Control plane nodes are upgraded first, then worker nodes (rolling)

Container Base Images​

  1. Harbor scans detect the vulnerability in a running image
  2. The upstream image is rebuilt or a patched version is pulled
  3. For air-gapped environments, a new Zarf package is built with the patched image

Notification Channels​

Security advisories are communicated through:

  • Git commits: Each patch includes a commit message referencing the CVE ID
  • Release notes: Tagged releases on openCenter-gitops-base list resolved CVEs
  • Customer communication: Critical and High severity CVEs are communicated directly to affected customers with remediation steps

Checking for Known Vulnerabilities​

Scan running images with Harbor​

Navigate to Harbor UI → Projects → select project → Repositories. Each image shows its scan status and vulnerability count.

Scan locally with Trivy​

# Scan a specific image
trivy image <registry>/<image>:<tag>

# Scan all images in a Helm release
kubectl get pods -n <namespace> -o jsonpath='{.items[*].spec.containers[*].image}' | tr ' ' '\n' | sort -u | xargs -I{} trivy image {}

Check Kubernetes version for known CVEs​

kubectl version --short
# Compare against https://kubernetes.io/docs/reference/issues-security/official-cve-feed/

Reporting a Vulnerability​

If you discover a vulnerability in an openCenter component:

  1. Do not open a public GitHub issue
  2. Email the security contact listed in SECURITY.md in the affected repository
  3. Include: affected component, version, CVE ID (if known), reproduction steps
  4. Expect acknowledgment within 48 hours

Further Reading​