add introduction section to the official CVE feed README #168

mahmoud-sabra · 2025-10-04T22:32:23Z

What type of PR is this?

/kind documentation

What this PR does / why we need it:

This PR adds an introduction section to the README.md of the official Kubernetes CVE feed documentation.
The new section provides a structured overview explaining what the CVE feed is, who uses it, and what outputs it provides.
This helps contributors and users understand the purpose, audience, and structure of the CVE feed before diving into technical details.

Which issue(s) this PR is related to:

Fixes #141

Special notes for your reviewer:

The new introduction aligns with the Kubernetes documentation style and tone.
Added direct links to example CVEs (e.g., CVE-2023-5528, CVE-2023-3676).
The change is limited to documentation and does not affect scripts or functionality.

k8s-ci-robot · 2025-10-04T22:32:33Z

Hi @mahmoud-sabra. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

nmn3m · 2025-10-09T20:23:49Z

/ok-to-test

tabbysable · 2025-10-17T21:58:54Z

This looks great to me, thank you so much!
/lgtm

mtardy

Thanks for doing this, thinks it looks good overall as well but here are a few comments

mtardy · 2025-10-21T10:57:37Z

sig-security-tooling/cve-feed/README.md

-The official CVE feed is separated into two main components:
+## Introduction
+
+The **Kubernetes Official CVE Feed** provides an authoritative and machine-readable source of information about security vulnerabilities (CVEs) affecting Kubernetes.  


could you wrap all the lines to ~80 chars? (gq in vim)

mtardy · 2025-10-21T10:58:49Z

sig-security-tooling/cve-feed/README.md

+- [CVE-2023-3676](https://www.cve.org/CVERecord?id=CVE-2023-3676) — Kubernetes apiserver privilege escalation  
+- [CVE-2021-25741](https://www.cve.org/CVERecord?id=CVE-2021-25741) — Symlink vulnerability in volume mounts  
+
+---


Can you remove all the --- in your patch?

Suggested change

---

mtardy · 2025-10-21T11:03:34Z

sig-security-tooling/cve-feed/README.md

+- A **JSON feed** listing all issues labeled as [`official-cve-feed`](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue+label%3Aofficial-cve-feed+) in the [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes) repository.  
+- An **HTML and RSS view** available at [k8s.io/docs/reference/issues-security/official-cve-feed](https://kubernetes.io/docs/reference/issues-security/official-cve-feed/).  


Just a remark: could you change the formulation here? All the feeds are indeed the output and are distributed through the website. If you want a list I'd just put three item something like:

HTML: the page blablabla with the link to the page

JSON: the original feed format blabla with the link to the JSON

RSS: another view balbla with the link to the RSS

The way you put it here sounds a bit like mostly the JSON feed list the issues labeled as official-cve-feed. I think you can just put the details in the parts that explains how it works maybe?

mtardy · 2025-10-21T11:04:25Z

sig-security-tooling/cve-feed/README.md

+
+Each entry in the feed corresponds to an official CVE affecting Kubernetes, such as:  
+- [CVE-2023-5528](https://www.cve.org/CVERecord?id=CVE-2023-5528) — Kubernetes ingress-nginx controller vulnerability  
+- [CVE-2023-3676](https://www.cve.org/CVERecord?id=CVE-2023-3676) — Kubernetes apiserver privilege escalation  
+- [CVE-2021-25741](https://www.cve.org/CVERecord?id=CVE-2021-25741) — Symlink vulnerability in volume mounts  


not sure you need to bother with examples

mtardy · 2025-10-21T11:05:10Z

sig-security-tooling/cve-feed/README.md

+## Introduction
+
+The **Kubernetes Official CVE Feed** provides an authoritative and machine-readable source of information about security vulnerabilities (CVEs) affecting Kubernetes.  
+It helps developers, operators, and security professionals stay informed about officially recognized and triaged vulnerabilities in the Kubernetes ecosystem.


I'll put that with the other paragraph before, maybe not a newline?

k8s-ci-robot · 2025-10-21T11:05:41Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mahmoud-sabra
Once this PR has been reviewed and has the lgtm label, please ask for approval from tabbysable. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

sig-security-tooling/cve-feed/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tabbysable · 2025-10-27T23:09:58Z

/lgtm

mtardy · 2025-10-28T09:02:34Z

sig-security-tooling/cve-feed/README.md

+- **JSON** — the original, machine-readable feed listing all issues
+  labeled as
+  [`official-cve-feed`](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue+label%3Aofficial-cve-feed+)
+  in the
+  [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
+  repository
+- **RSS** — a syndication-friendly view for integration into monitoring
+  or alerting tools
+
+Each entry in these feeds corresponds to an official CVE affecting
+Kubernetes.


Suggested change

- **JSON** — the original, machine-readable feed listing all issues

labeled as

[`official-cve-feed`](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue+label%3Aofficial-cve-feed+)

in the

[kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)

repository

- **RSS** — a syndication-friendly view for integration into monitoring

or alerting tools

Each entry in these feeds corresponds to an official CVE affecting

Kubernetes.

- **JSON** — the original machine-readable feed available at

[k8s.io/docs/reference/issues-security/official-cve-feed/index.json](https://kubernetes.io/docs/reference/issues-security/official-cve-feed/index.json).

- **RSS** — a syndication-friendly view for integration into monitoring

or alerting tools available at

[k8s.io/docs/reference/issues-security/official-cve-feed/feed.xml](https://kubernetes.io/docs/reference/issues-security/official-cve-feed/feed.xml).

Each entry in these feeds corresponds to an official CVE affecting

Kubernetes retrieved from an issue labeled as

[`official-cve-feed`](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue+label%3Aofficial-cve-feed+)

in the [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)

repository.

thank you Mahe, your format is better than me, i will use it

mtardy · 2025-10-28T09:03:19Z

sig-security-tooling/cve-feed/README.md

+
+

nit: remove double whiteline

Suggested change

mtardy · 2025-10-28T09:04:07Z

sig-security-tooling/cve-feed/README.md

+A script in the
+[kubernetes/sig-security](https://github.com/kubernetes/sig-security)


it's okay to go over 80 chars when you have links if you want btw, not a stricti rule, the wrapping is just to ease reviewing and git history change by line

Suggested change

A script in the

[kubernetes/sig-security](https://github.com/kubernetes/sig-security)

A script in the [kubernetes/sig-security](https://github.com/kubernetes/sig-security)

mtardy · 2025-10-28T09:05:57Z

sig-security-tooling/cve-feed/README.md

- if the sha256 changed, uploads the newly generated CVE feed file to the bucket.
+- if the sha256 changed, uploads the newly generated CVE feed file to
+  the bucket.

-The `fetch-official-cve-feed.py` file executed by the `fetch-cve-feed.sh` is a
-python3 script that:
- queries the GitHub API to fetch all the issues with the `official-cve-feed`
-  label in the [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue%20label%3Aofficial-cve-feed%20)
+The `fetch-official-cve-feed.py` file executed by
+`fetch-cve-feed.sh` is a Python 3 script that:
+- queries the GitHub API to fetch all issues with the `official-cve-feed`
+  label in the
+  [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue%20label%3Aofficial-cve-feed%20)
  repository;
- formats the result with the appropriate JSON schema to be JSON feed
-  compliant;
+- formats the result according to the JSON Feed schema;
 - prints the output to stdout.

-These scripts are run regularly as a CronJob on the k8s infrastructure.
+These scripts are run regularly as a CronJob on the Kubernetes
+infrastructure.


pplease do not touch unchanged lines (these lines + everything that you wrapped until reference I think) (so that we don't mess up git history)

ok, i did it by mistake, i will keep them untouched next commit

just a quick question @mtardy could i close this pr and open a clean one instead?
if not, should i revert these lines back to the original or just keep them untouched the next commit?, i prefer to close this PR and just open a clean one

No harm in closing this PR and opening a clean one with all the fixes, if that's what you prefer.

Indeed that's okay if that's the easiest for you.

But otherwise, learning how to rebase a patch set is a nice skill to have: https://docs.github.com/en/get-started/using-git/about-git-rebase. Then you can juste git push <forkref> HEAD --force-with-lease and everything should look good. That's how I work personally because on all my main repos we just allow to merge and rebase.

Or you can repush the revert of that part of the commit by git revert <commitsha> and then git reset HEAD~ and then git add . --patch and add only what you want to revert. We can then squash everything together at merge time.

mtardy · 2025-10-28T09:06:11Z

sig-security-tooling/cve-feed/README.md

+
+

nit: double whitelines

Suggested change

tabbysable · 2025-11-21T17:08:47Z

@mahmoud-sabra this is looking pretty good, let's try to get it merged!

k8s-ci-robot added kind/documentation Categorizes issue or PR as related to documentation. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Oct 4, 2025

k8s-ci-robot requested review from PushkarJ and mtardy October 4, 2025 22:32

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 4, 2025

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 4, 2025

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 9, 2025

k8s-ci-robot assigned tabbysable Oct 17, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 17, 2025

mtardy suggested changes Oct 21, 2025

View reviewed changes

mahmoud-sabra added 2 commits October 26, 2025 22:55

add introduction section to the official CVE feed README

2e78ed2

docs: wrap lines to 80 chars and clarify feed formats (HTML, JSON, RSS)

d824f11

mahmoud-sabra force-pushed the add-cve-feed-introduction branch from 413f8e1 to d824f11 Compare October 26, 2025 20:15

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 26, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 27, 2025

mtardy suggested changes Oct 28, 2025

View reviewed changes

		- A JSON feed listing all issues labeled as [`official-cve-feed`](https://github.com/kubernetes/kubernetes/issues?q=is%3Aissue+label%3Aofficial-cve-feed+) in the [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes) repository.
		- An HTML and RSS view available at [k8s.io/docs/reference/issues-security/official-cve-feed](https://kubernetes.io/docs/reference/issues-security/official-cve-feed/).

		A script in the
		[kubernetes/sig-security](https://github.com/kubernetes/sig-security)

	A script in the
	[kubernetes/sig-security](https://github.com/kubernetes/sig-security)
	A script in the [kubernetes/sig-security](https://github.com/kubernetes/sig-security)

add introduction section to the official CVE feed README #168

Are you sure you want to change the base?

add introduction section to the official CVE feed README #168

Uh oh!

Conversation

mahmoud-sabra commented Oct 4, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Uh oh!

k8s-ci-robot commented Oct 4, 2025

Uh oh!

nmn3m commented Oct 9, 2025

Uh oh!

tabbysable commented Oct 17, 2025

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Oct 21, 2025

Uh oh!

tabbysable commented Oct 27, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mtardy Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tabbysable commented Nov 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mtardy Oct 28, 2025 •

edited

Loading