summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMorgan Richomme <morgan.richomme@orange.com>2016-07-06 15:36:10 +0000
committerGerrit Code Review <gerrit@172.30.200.206>2016-07-06 15:36:10 +0000
commite7db19964ae5137ccbec4b39a09a52e19241d32e (patch)
treed6982ad90dbc2c0f58fd9ac0eea66d8285b0e19b
parentc92a48a163a7161874cfb01edcf79e6a721985ba (diff)
parent5eabccc1ed6d050cd5ce24944346a1128e49b9f5 (diff)
Merge "Adding security_scan section to functest userguide."
-rw-r--r--docs/userguide/index.rst30
1 files changed, 29 insertions, 1 deletions
diff --git a/docs/userguide/index.rst b/docs/userguide/index.rst
index ea2679764..327a1756b 100644
--- a/docs/userguide/index.rst
+++ b/docs/userguide/index.rst
@@ -388,9 +388,35 @@ the OpenStack 'bgpvpn' API:
security_scan
^^^^^^^^^^^^^
-**TODO:**
+Security Scanning, is a project to insure security compliance and vulnerability
+checks, as part of an automated CI / CD platform delivery process.
+
+The project makes use of the existing SCAP format[6] to perform deep scanning of
+NFVi nodes, to insure they are hardened and free of known CVE reported vulnerabilities.
+
+The SCAP content itself, is then consumed and run using an upstream opensource tool
+known as OpenSCAP[7].
+
+The OPNFV Security Group have developed the code that will called by the OPNFV Jenkins
+build platform, to perform a complete scan. Resulting reports are then copied to the
+OPNFV functest dashboard.
+
+The current work flow is as follows:
+ * Jenkins Build Initiated
+ * security_scan.py script is called, and a config file is passed to the script as
+ an argument.
+ * The IP addresses of each NFVi node (compute / control), is gathered.
+ * A scan profile is matched to the node type.
+ * The OpenSCAP application is remotely installed onto each target node gathered
+ on step 3, using upstream packaging (rpm and .deb).
+ * A scan is made against each node gathered within step 3.
+ * HTML Reports are downloaded for rendering on a dashboard.
+ * If the config file value 'clean' is set to 'True' then the application installed in
+ step 5 is removed, and all reports created at step 6 are deleted.
+At present, only the Apex installer is supported, with support for other installers due
+within D-release.
VNF
---
@@ -449,6 +475,8 @@ References
.. _`[3]`: https://rally.readthedocs.org/en/latest/index.html
.. _`[4]`: http://events.linuxfoundation.org/sites/events/files/slides/Functest%20in%20Depth_0.pdf
.. _`[5]`: https://github.com/Orange-OpenSource/opnfv-cloudify-clearwater/blob/master/openstack-blueprint.yaml
+.. _`[6]`: https://scap.nist.gov/
+.. _`[7]`: https://github.com/OpenSCAP/openscap
.. _`[9]`: https://git.opnfv.org/cgit/functest/tree/testcases/VIM/OpenStack/CI/libraries/os_defaults.yaml
.. _`[11]`: http://robotframework.org/