Add near-live refresh for CVE feed page

[ahmedavid]

Edited cve-feed.html to add script that fetches cve json feed and updates cve table periodically.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign reylejano for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: ahmedavid / name: David Ahmadov (6140c99, 0f3b7ee, a67d93d, 84eae82, 4baf7b5, 35f2724)

[k8s-ci-robot]

Welcome @ahmedavid!

It looks like this is your first PR to kubernetes/website 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/website has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[netlify]

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	35f2724
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/6564c2af972ebb0007864c37
😎 Deploy Preview	https://deploy-preview-44074--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[sftim]

/retitle Add near-live refresh for CVE feed page

[sftim]

/area web-development

[sftim]

Thank you for the PR.

This does not close #43968 (there will still be more work to do, around generating the JSON feed data more frequently)

Please update the PR description to reflect that @ahmedavid

[ahmedavid]

Hi @sftim , I changed the description. First part was straight forward. But I have no clue about second part. I am happy to help but I need some pointers.

PR description was updated

[sftim]

Thanks for updating the PR description. If / when this is reviewed and approved, I expect we'll be able to merge this change without waiting on an update that addresses the other part (generating the feed data more often).

[ahmedavid]

I have couple of concerns

1. Initially I embedded <script>...</script> directly inside cve-feed short code. Maybe better approach is to extract it to static folder where other js are. Also we can put defer attribute to run it after page is rendered. Should I bother, because this works?!

2. Administrative concerns is, do I need to pursue reviewers/approvers or they will show up eventually?!

[ahmedavid]

/assign

[sftim]

This kind of works; the code is not wrong but, it's still not the whole solution.

Actually, there's a different thing we can do. We can skip all this change and instead trigger a whole-site deploy whenever there is a diff between the public CVE feed and the source data in GCP. And some Kubernetes infrastructure could do that fix once every 10 minutes.

[ahmedavid]

This kind of works; the code is not wrong but, it's still not the whole solution.

Actually, there's a different thing we can do. We can skip all this change and instead trigger a whole-site deploy whenever there is a diff between the public CVE feed and the source data in GCP. And some Kubernetes infrastructure could do that fix once every 10 minutes.

Can you point me to the code that generates json?

Redeploy website every 10 mins? That doesn't sound like a good idea to me. I think all we need to do is to make sure json is updated frequently on some backend , I don't know where.

[sftim]

Redeploy website every 10 mins? That doesn't sound like a good idea to me.

Every 10 mins:

• check if https://k8s.io/docs/reference/issues-security/official-cve-feed/index.json is out of date (by comparing it to the data in the GCP object storage)
• if so: trigger a site rebuild

This will trigger approximately 10 rebuilds a year, which is fine. It will also add a few HTTP GETs to our served traffic (which is about 10 TB / month IIRC).

See kubernetes/sig-security#1 for the overall issue tracker and more context.

[sftim]

misclicked!
/reopen

[k8s-ci-robot]

@sftim: Reopened this PR.

In response to this:

misclicked!
/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ahmedavid]

Redeploy website every 10 mins? That doesn't sound like a good idea to me.

Every 10 mins:

• check if https://k8s.io/docs/reference/issues-security/official-cve-feed/index.json is out of date (by comparing it to the data in the GCP object storage)
• if so: trigger a site rebuild

This will trigger approximately 10 rebuilds a year, which is fine. It will also add a few HTTP GETs to our served traffic (which is about 10 TB / month IIRC).

See kubernetes/sig-security#1 for the overall issue tracker and more context.

And where this logic would run?

Reading through the KEP I can't tell if there is some kind of script exists that implements Design Details steps 1,2,3,4. Or they put a one time static file into the bucket and that is what we are getting. If such script or automation does not exist. First that part needs to be done. Can you confirm if that part is already done?

[sftim]

Reading through the KEP I can't tell if there is some kind of script exists that implements Design Details steps 1,2,3,4. Or they put a one time static file into the bucket and that is what we are getting. If such script or automation does not exist. First that part needs to be done. Can you confirm if that part is already done?

I'm going to step back from this conversation (as I have around 80 other things I'm also involved in for Kubernetes, and there is an upcoming release); I hope other contributors step in.
You could also ask in #sig-docs and #sig-security on the Kubernetes Slack workspace @ahmedavid - see https://slack.k8s.io/ if you are not already a user there.

[ahmedavid]

Reading through the KEP I can't tell if there is some kind of script exists that implements Design Details steps 1,2,3,4. Or they put a one time static file into the bucket and that is what we are getting. If such script or automation does not exist. First that part needs to be done. Can you confirm if that part is already done?

I'm going to step back from this conversation (as I have around 80 other things I'm also involved in for Kubernetes, and there is an upcoming release); I hope other contributors step in. You could also ask in #sig-docs and #sig-security on the Kubernetes Slack workspace @ahmedavid - see https://slack.k8s.io/ if you are not already a user there.

Appreciate your input so far, thanks.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[dipesh-rawat]

/remove-lifecycle stale

[dipesh-rawat]

Consider incorporating this script into the header or footer of the page, loading conditionally based on the presence of the HasShortcode parameter.

For guidance, refer to the tips provided at https://gohugo.io/templates/shortcode-templates/ and refer our existing layouts to see how we handle 'HasShortcode'.

[dipesh-rawat]

Additionally, we should also refresh the table caption when fetching new data, as it provides the timestamp indicating the last update of the CVE feed data.

[dipesh-rawat]

💭 How about adding a refresh/fetch button in the corner of the table, alongside this auto-trigger logic of every 10 minutes? This button could be used explicitly to refresh the feed table data.

[dipesh-rawat]

In the deploy preview (here), I've see following a CORS policy error:

Access to fetch at 'https://storage.googleapis.com/k8s-cve-feed/official-cve-feed.json' from origin 'https://deploy-preview-44074--kubernetes-io-main-staging.netlify.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

I'm hoping that this cross-site script error will be gone in the production build at kubernetes.io

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ericsmalling]

I'm not qualified to weigh in on the code changes here - is there anyone researching the review comments?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale