Vulnerability proofing a node while onboarding to a container orchestration platform
Vulnerability proofing a node (e.g., an Information handling System (IHS)) while onboarding the node to a container orchestration platform may include detecting onboarding of the node IHS to the container orchestration platform, which includes vulnerability management service instructions and an onboarding handler component. The onboarding including configuring (a) hardware component(s) of the IHS, and the vulnerability proofing may include executing the vulnerability management service instructions, which results in accessing (a) catalog(s) specifying known vulnerabilities of hardware components of the IHS and determining whether any of the configuring of any of the configurations of (a) hardware component(s) of the IHS are identified as vulnerable in the catalog(s). The onboarding of the IHS to the container orchestration platform by the IHS may be blocked until configuring the hardware component(s) of the IHS is modified to include no configuring of the hardware component(s) with vulnerabilities identified in the catalog(s).
1 . An Information Handling System (IHS) comprising:
one or more CPUs utilizing one or more buses that connect to a plurality of hardware components of the IHS; and
a remote access controller supporting remote management of the Information Handling System (IHS), the remote access controller comprising a logic unit and a memory device having instructions stored thereon that, upon execution by the logic unit, cause the remote access controller to:
detect launch of a process for onboarding the IHS to a container orchestration platform that comprises vulnerability management service instructions and an onboarding handler component; and
execute the vulnerability management service instructions, which causes the remote controller to:
identify configurations for one or more of the plurality of hardware components of the IHS in the process for onboarding the IHS to the container orchestration platform;
access a plurality of catalogs specifying known vulnerabilities of hardware components;
determine whether any of the one or more of the hardware component configurations in the process for onboarding the IHS to the container orchestration platform are identified as vulnerable in one or more of the catalogs; and
block use of the process for onboarding the IHS to the container orchestration platform by the IHS until the hardware component configurations within the process for onboarding the IHS to the container orchestration platform are modified to include no configurations with vulnerabilities identified in the plurality of catalogs.
2 . The IHS of claim 1 , wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of the IHS.
3 . The IHS of claim 2 , wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of one or more of the plurality of hardware components of the IHS.
4 . The IHS of claim 1 , wherein execution of the vulnerability management service instructions further causes the remote access controller to identify, within a factory provisioned identity certificate of the IHS, one or more vulnerability proofing requirements for the IHS.
5 . The IHS of claim 4 , wherein the factory-provisioned identity certificate comprises digital signatures for authenticating instructions used by one or more of the hardware components of the IHS.
6 . The IHS of claim 4 , wherein the validation proofing requirements in the inventory certificate further specify the plurality of catalogs of known vulnerabilities for use in identifying hardware component configurations that are vulnerable.
7 . The IHS of claim 1 , wherein execution of the instructions further causes the remote access controller to notify an administrator for each blocked use of the process for onboarding the IHS to the container orchestration platform due to configurations with vulnerabilities.
8 . The IHS of claim 1 , wherein the configurations of the process for onboarding the IHS to the container orchestration platform comprises a firmware update for instructions used to operate one of the hardware components.
9 . The IHS of claim 8 , wherein the vulnerability catalogs specify an alternate firmware version that is used to operate the hardware component and that is not associated with known vulnerabilities.
10 . A method for vulnerability proofing an Information Handling System (IHS) node while onboarding the IHS to a container orchestration platform, the vulnerability proofing implemented by a remote access controller of the IHS that provides remote management of the IHS, the method comprising:
detecting onboarding of the IHS to a container orchestration platform comprising vulnerability management service instructions and an onboarding handler component, the onboarding comprising configuring for one or more of a plurality of hardware components of the IHS and; and
executing the vulnerability management service instructions, comprising:
accessing a plurality of catalogs specifying known vulnerabilities of hardware components of the IHS;
determining whether any of the configuring of any of the one or more of the configurations for one or more of a plurality of hardware components of the IHS are identified as vulnerable in one or more of the catalogs; and
blocking the onboarding of the IHS to the container orchestration platform by the IHS until the configuring of the one or more hardware components of a plurality of hardware components of the IHS is modified to include no configuring of the one or more hardware components of a plurality of hardware components of the IHS with vulnerabilities identified in the plurality of catalogs.
11 . The method of claim 10 , wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of the IHS.
12 . The method of claim 11 , wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of one or more of the plurality of hardware components of the IHS.
13 . The method of claim 10 , further comprising identifying one or more vulnerability proofing requirements for the IHS within a factory provisioned identity certificate of the IHS.
14 . The method of claim 13 , wherein the factory-provisioned identity certificate is cryptographically bound to the remote access controller of the IHS.
15 . The method of claim 13 , wherein the vulnerability proofing requirements further specify the plurality of catalogs of known vulnerabilities for use in identifying hardware component configurations that are vulnerable.
16 . The method of claim 10 , wherein the vulnerability catalogs specify workload configurations with alternate firmware versions that are not associated with known vulnerabilities.
17 . A remote access controller supporting remote management of an Information Handling System (IHS), the remote access controller comprising a memory device having instructions stored thereon that, upon execution by a logic unit, cause the remote access controller to:
detect launch of a process for onboarding the IHS to a container orchestration platform that comprises vulnerability management service instructions and an onboarding handler component; and
execute the vulnerability management service instructions, which causes the remote access controller to:
access a plurality of catalogs specifying known vulnerabilities of hardware components;
determine whether the process for onboarding the IHS to the container orchestration platform comprises configuring one or more of a plurality of hardware components of the IHS with a configuration identified as vulnerable in one or more of the catalogs; and
block use of the process for onboarding the IHS to the container orchestration platform by the IHS until the configuring of one or more of the plurality of hardware components of the IHS with a configuration identified as vulnerable in one or more of the catalogs are modified to include no configurations with vulnerabilities identified in the plurality of catalogs.
18 . The remote access controller of claim 17 , wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of the IHS.
19 . The remote access controller of claim 17 , wherein the plurality of catalogs comprise a catalog of hardware component vulnerabilities known to a manufacturer of one or more of the plurality of hardware components of the IHS.
20 . The remote access controller of claim 17 , wherein execution of the vulnerability management service instructions further causes the remote access controller to identify one or more vulnerability proofing requirements for onboarding the IHS to the container orchestration platform within a factory provisioned identity certificate of the IHS.