Skip to content

Commit 39c6760

Browse files
saschagrunertsaschagrunert
committed
Add node-cve plugin for daily Node team CVE triage
New plugin that queries open OCPBUGS Vulnerability issues for all Node team components, clones affected repos, and uses Claude to analyze source code for CVE reachability. Reports findings to Jira and Slack. Works across Go, Rust, and C codebases. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
1 parent d4833ba commit 39c6760

10 files changed

Lines changed: 920 additions & 0 deletions

File tree

‎.claude-plugin/marketplace.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,12 @@
181181
"description": "Kubernetes and OpenShift node health monitoring and diagnostics",
182182
"version": "0.0.3"
183183
},
184+
{
185+
"name": "node-cve",
186+
"source": "./plugins/node-cve",
187+
"description": "Daily CVE triage for OpenShift Node team components",
188+
"version": "0.0.1"
189+
},
184190
{
185191
"name": "bigquery",
186192
"source": "./plugins/bigquery",

‎PLUGINS.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ This document lists all available Claude Code plugins and their commands in the
2020
- [Marketplace Ops](#marketplace-ops-plugin)
2121
- [Must Gather](#must-gather-plugin)
2222
- [Node](#node-plugin)
23+
- [Node Cve](#node-cve-plugin)
2324
- [Node Tuning](#node-tuning-plugin)
2425
- [Olm](#olm-plugin)
2526
- [Olm Team](#olm-team-plugin)
@@ -259,6 +260,15 @@ Kubernetes and OpenShift node health monitoring and diagnostics
259260

260261
See [plugins/node/README.md](plugins/node/README.md) for detailed documentation.
261262

263+
### Node Cve Plugin
264+
265+
Daily CVE triage for OpenShift Node team components
266+
267+
**Commands:**
268+
- **`/node-cve:triage` `[--component <name>] [--notify-jira] [--notify-slack] [--days N]`** - Triage all open CVEs for OpenShift Node team components with reachability analysis
269+
270+
See [plugins/node-cve/README.md](plugins/node-cve/README.md) for detailed documentation.
271+
262272
### Node Tuning Plugin
263273

264274
Automatically create and apply tuned profile

‎docs/data.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1693,6 +1693,39 @@
16931693
"skills": [],
16941694
"version": "0.0.3"
16951695
},
1696+
{
1697+
"commands": [
1698+
{
1699+
"argument_hint": "[--component <name>] [--notify-jira] [--notify-slack] [--days N]",
1700+
"description": "Triage all open CVEs for OpenShift Node team components with reachability analysis",
1701+
"example": "",
1702+
"name": "triage",
1703+
"synopsis": "/node-cve:triage [--component \"Node / CRI-O\"] [--notify-jira] [--notify-slack] [--days 7]"
1704+
}
1705+
],
1706+
"description": "Daily CVE triage for OpenShift Node team components",
1707+
"has_readme": true,
1708+
"hooks": [],
1709+
"name": "node-cve",
1710+
"skills": [
1711+
{
1712+
"description": "Clone affected repositories and analyze CVE reachability through source code inspection",
1713+
"id": "analyze-cve-repos",
1714+
"name": "analyze-cve-repos"
1715+
},
1716+
{
1717+
"description": "Query and deduplicate open CVE vulnerability issues from OCPBUGS for Node team components",
1718+
"id": "query-open-cves",
1719+
"name": "query-open-cves"
1720+
},
1721+
{
1722+
"description": "Generate triage reports and post findings to Jira and Slack",
1723+
"id": "report-findings",
1724+
"name": "report-findings"
1725+
}
1726+
],
1727+
"version": "0.0.1"
1728+
},
16961729
{
16971730
"commands": [
16981731
{

‎plugins/node-cve/.claude-plugin/plugin.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name": "node-cve",
3+
"description": "Daily CVE triage for OpenShift Node team components",
4+
"version": "0.0.1",
5+
"author": {
6+
"name": "github.com/openshift-eng"
7+
}
8+
}

‎plugins/node-cve/OWNERS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
approvers:
2+
- saschagrunert
3+
reviewers:
4+
- saschagrunert

‎plugins/node-cve/README.md‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# Node CVE Plugin
2+
3+
Daily CVE triage for OpenShift Node team components. Queries open vulnerability issues from OCPBUGS, runs reachability analysis against affected repositories, and reports findings to Jira and Slack.
4+
5+
## Command
6+
7+
### `/node-cve:triage [--component <name>] [--notify-jira] [--notify-slack] [--days N]`
8+
9+
Triage all open CVEs for Node team components with automated reachability analysis.
10+
11+
**Example:**
12+
```text
13+
/node-cve:triage --notify-jira --notify-slack
14+
```
15+
16+
**What it does:**
17+
18+
1. Queries OCPBUGS for open Vulnerability issues across all Node team components (CRI-O, Kubelet, MCO, etc.)
19+
2. Deduplicates by CVE ID (each CVE has multiple version trackers)
20+
3. Clones affected repositories and analyzes source code for reachability
21+
4. Classifies each CVE: REACHABLE, PRESENT_NOT_EXPLOITABLE, PRESENT_NOT_REACHABLE, NOT_AFFECTED, or UNCERTAIN
22+
5. Generates a triage report with confidence levels and recommended actions
23+
6. Optionally posts analysis comments to all Jira tracker issues
24+
7. Optionally sends a summary to Slack
25+
26+
**Arguments:**
27+
- `--component <name>`: Filter to a specific component (e.g., "Node / CRI-O")
28+
- `--notify-jira`: Post analysis results as comments on Jira tracker issues
29+
- `--notify-slack`: Send summary to Slack webhook
30+
- `--days N`: Only include CVEs updated in the last N days (default: all open)
31+
32+
**Output:**
33+
- Summary table printed to stdout
34+
- Full report at `.work/node-cve/triage-YYYY-MM-DD/report.md`
35+
- Structured data at `.work/node-cve/triage-YYYY-MM-DD/cves.json`
36+
- Per-CVE analysis files in `.work/node-cve/triage-YYYY-MM-DD/`
37+
38+
## Prerequisites
39+
40+
```bash
41+
# Jira CLI
42+
# See https://github.com/ankitpokhrel/jira-cli
43+
44+
# git (for cloning repos)
45+
# curl (for --notify-slack)
46+
```
47+
48+
**Environment variables:**
49+
- `JIRA_API_TOKEN` - Jira API token (required)
50+
- `JIRA_USERNAME` - Jira username/email (required)
51+
- `SLACK_WEBHOOK` - Slack incoming webhook URL (required for `--notify-slack`)
52+
53+
## Headless Execution
54+
55+
Run as a scheduled job using the ai-helpers container:
56+
57+
```bash
58+
podman run -it \
59+
-e CLAUDE_CODE_USE_VERTEX=1 \
60+
-e ANTHROPIC_VERTEX_PROJECT_ID=your-project \
61+
-e JIRA_API_TOKEN=... \
62+
-e JIRA_USERNAME=... \
63+
-e SLACK_WEBHOOK=... \
64+
-v ~/.config/gcloud:/home/claude/.config/gcloud:ro \
65+
ai-helpers --print "/node-cve:triage --notify-jira --notify-slack"
66+
```
67+
68+
### OpenShift CronJob
69+
70+
```yaml
71+
apiVersion: batch/v1
72+
kind: CronJob
73+
metadata:
74+
name: node-cve-triage
75+
namespace: node-team
76+
spec:
77+
schedule: "3 8 * * 1-5"
78+
jobTemplate:
79+
spec:
80+
template:
81+
spec:
82+
containers:
83+
- name: triage
84+
image: ai-helpers:latest
85+
args: ["--print", "/node-cve:triage --notify-jira --notify-slack"]
86+
envFrom:
87+
- secretRef:
88+
name: cve-triage-secrets
89+
restartPolicy: OnFailure
90+
```
91+
92+
## Node Team Components
93+
94+
The plugin covers all OCPBUGS components owned by the Node team:
95+
96+
| Component | Repository | Language |
97+
|-----------|-----------|----------|
98+
| Node / CRI-O | cri-o/cri-o | Go |
99+
| Node / Kubelet | openshift/kubernetes | Go |
100+
| Node / CPU manager | openshift/kubernetes | Go |
101+
| Node / Device Manage | openshift/kubernetes | Go |
102+
| Node / Memory manager | openshift/kubernetes | Go |
103+
| Node / Numa aware Scheduling | openshift/kubernetes | Go |
104+
| Node / Pod resource API | openshift/kubernetes | Go |
105+
| Node / Topology manager | openshift/kubernetes | Go |
106+
| Driver Toolkit | openshift/driver-toolkit | Go |
107+
| Machine Config Operator | openshift/machine-config-operator | Go |
108+
109+
Additional repos detected via `pscomponent:` labels: cadvisor (Go), conmon (C), conmon-rs (Rust + Go), cri-tools (Go).
110+
111+
## Reachability Classification
112+
113+
| Classification | Meaning |
114+
|---------------|---------|
115+
| REACHABLE | Vulnerable code path is reachable from entry points with attacker-controlled input |
116+
| PRESENT_NOT_EXPLOITABLE | Vulnerable function is called, but only with trusted/internal data |
117+
| PRESENT_NOT_REACHABLE | Vulnerable package is a dependency but the specific vulnerable functions are not called |
118+
| NOT_AFFECTED | Vulnerable package is not in the dependency tree |
119+
| UNCERTAIN | Analysis could not determine (repo too large, CVE details insufficient, etc.) |
120+
121+
Each classification includes a confidence level (HIGH/MEDIUM/LOW) based on the depth of source code analysis performed.

0 commit comments

Comments
 (0)