docs: clarify how upgrades are evaluated #3935

lennessyy · 2024-09-16T20:51:38Z

Describe the Change

This PR clarifies how upgrades are evaluated based on pause settings.

Changed Pages

💻 Pause agent upgrades

Jira Tickets

🎫 DOC-1380

Backports

Can this PR be backported?

Yes.

netlify · 2024-09-16T20:51:51Z

❌ Deploy Preview for docs-spectrocloud failed. Why did it fail? →

Name	Link
🔨 Latest commit	`a71c16f`
🔍 Latest deploy log	https://app.netlify.com/sites/docs-spectrocloud/deploys/66edad2d57190b0008aeafd8

vault-token-factory-spectrocloud · 2024-09-16T21:02:35Z

Images automagically compressed by Calibre's image-actions ✨

Compression reduced images by 70.5%, saving 212.20 KB.

Filename	Before	After	Improvement	Visual comparison
`static/assets/docs/images/clusters_cluster-management_platform-settings_pause-agent-upgrade-flow.webp`	301.14 KB	88.94 KB	-70.5%	View diff

723 images did not require optimisation.

…/librarium into pause-agent-upgrade

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

github-actions · 2024-09-20T16:07:53Z

docs/docs-content/security-bulletins/reports/cve-2023-4911.md

+
+## Last Update
+
+9/17/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '9/17/2024'.

github-actions · 2024-09-20T16:07:53Z

docs/docs-content/security-bulletins/reports/cve-2023-4911.md

+## Images
+
+- ghcr.io/k8snetworkplumbingwg/multus-cni:v4.0.2-thick
+- gcr.io/spectro-images-public/velero/velero:v1.9.7-spectro20240625


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Spectro' instead of 'spectro'.

github-actions · 2024-09-20T16:07:53Z

docs/docs-content/security-bulletins/reports/cve-2023-4911.md

+## Images
+
+- ghcr.io/k8snetworkplumbingwg/multus-cni:v4.0.2-thick
+- gcr.io/spectro-images-public/velero/velero:v1.9.7-spectro20240625


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Velero' instead of 'velero'.

github-actions · 2024-09-20T16:07:53Z

docs/docs-content/security-bulletins/reports/cve-2023-4911.md

+## Images
+
+- ghcr.io/k8snetworkplumbingwg/multus-cni:v4.0.2-thick
+- gcr.io/spectro-images-public/velero/velero:v1.9.7-spectro20240625


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Velero' instead of 'velero'.

docs/docs-content/security-bulletins/reports/cve-2017-7245.md

github-actions · 2024-09-20T16:07:54Z

docs/docs-content/security-bulletins/reports/cve-2022-3996.md

+
+## Last Update
+
+8/1/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '8/1/2024'.

github-actions · 2024-09-20T16:07:54Z

docs/docs-content/security-bulletins/reports/cve-2022-3996.md

+argument to the command line utilities or by calling the
+\`X509_VERIFY_PARAM_set1_policies()' function.
+
+Update (31 March 2023): The description of the policy processing enablement


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '31 March 2023'.

github-actions · 2024-09-20T16:07:54Z

docs/docs-content/security-bulletins/reports/cve-2022-3996.md

+argument to the command line utilities or by calling the
+\`X509_VERIFY_PARAM_set1_policies()' function.
+
+Update (31 March 2023): The description of the policy processing enablement


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Enablement' instead of 'enablement'.

github-actions · 2024-09-20T16:07:55Z

docs/docs-content/security-bulletins/reports/cve-2022-3996.md

+
+## Images
+
+- gcr.io/spectro-images-public/release/kubevirt/virt-handler:v1.2.0


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Spectro' instead of 'spectro'.

github-actions · 2024-09-20T16:07:55Z

docs/docs-content/security-bulletins/reports/cve-2022-3996.md

+## Images
+
+- gcr.io/spectro-images-public/release/kubevirt/virt-handler:v1.2.0
+- gcr.io/spectro-images-public/release/kubevirt/virt-launcher:v1.2.0


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Spectro' instead of 'spectro'.

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

github-actions · 2024-09-20T16:10:37Z

docs/docs-content/security-bulletins/reports/cve-2022-4450.md

+
+## NIST Summary
+
+The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Latin] Use 'for example' instead of 'e.g.'.

github-actions · 2024-09-20T16:10:37Z

docs/docs-content/security-bulletins/reports/cve-2022-4450.md

+## NIST Summary
+
+The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any
+header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Quotes] Commas and periods go inside quotation marks.

github-actions · 2024-09-20T16:10:37Z

docs/docs-content/security-bulletins/reports/cve-2022-4450.md

+## NIST Summary
+
+The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any
+header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'name_out'?

github-actions · 2024-09-20T16:10:37Z

docs/docs-content/security-bulletins/reports/cve-2023-5363.md

+
+## NIST Summary
+
+Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.acronym] Use title case to define the acronym '(IV)'.

github-actions · 2024-09-20T16:10:37Z

docs/docs-content/security-bulletins/reports/cve-2023-5363.md

+some cipher modes.
+
+When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is
+processed after the key and IV have been established. Any alterations to the key length, via the "keylen" parameter or


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'keylen'?

github-actions · 2024-09-20T16:10:39Z

docs/docs-content/security-bulletins/reports/cve-2023-0286.md

+
+## Images
+
+- gcr.io/spectro-images-public/release/kubevirt/virt-handler:v1.2.0


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Spectro' instead of 'spectro'.

github-actions · 2024-09-20T16:10:39Z

docs/docs-content/security-bulletins/reports/cve-2023-0286.md

+## Images
+
+- gcr.io/spectro-images-public/release/kubevirt/virt-handler:v1.2.0
+- gcr.io/spectro-images-public/release/kubevirt/virt-launcher:v1.2.0


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Spectro' instead of 'spectro'.

github-actions · 2024-09-20T16:10:39Z

docs/docs-content/security-bulletins/reports/cve-2022-27191.md

+
+## Last Update
+
+11/7/2023


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '11/7/2023'.

github-actions · 2024-09-20T16:10:39Z

docs/docs-content/security-bulletins/reports/cve-2022-27191.md

+
+## Images
+
+- gcr.io/spectro-images-client/release/nas:4.4.14


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'Spectro' instead of 'spectro'.

github-actions · 2024-09-20T16:10:39Z

docs/docs-content/security-bulletins/reports/cve-2023-29404.md

+
+## Last Update
+
+11/25/2023


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '11/25/2023'.

antongisli

I left various comments and suggestions, feel free to accept or decline.
I still think that a simple table showing the expected behaviour based off how various settings are at a given point in time would be very helpful to understand all the text.
FOr example seeing that tenant pause is on, project is off, but cluster is on = cluster upgrades are paused, or tenant pause off, project is off, cluster is on = upgrades are paused, and tenant on, project on, cluster off = cluster upgrades are not paused would help illustrate things.

You may also want to get a review from @kreeuwijk

antongisli · 2024-09-20T16:00:52Z

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

@@ -8,11 +8,58 @@ tags: ["clusters", "cluster management"]
 ---

 Palette supports the **Pause Agent Upgrades** feature to exclude a cluster or a group of clusters from getting


this isn't correct, it is NOT about upgrading the cluster itself, only the agent that runs in the cluster

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

antongisli · 2024-09-20T16:08:49Z

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

+- Pause upgrades for all clusters within a project
+- Pause upgrades for all clusters within a tenant
+
+When determining if the agent upgrades for one cluster is paused or not, you only need to look at the setting for the


Maybe:
"Agent upgrade settings are always applied based on individual cluster settings. Project and Tenant agent upgrade settings are not inherited - instead cluster level settings are set to match each time Project and Tenant level settings are changed."

antongisli · 2024-09-20T16:09:54Z

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

+Pausing or resuming agent upgrades at a higher-level scope will automatically pause or resume agent upgrades in the
+lower-level scopes. For example, if you pause agent upgrades at the tenant level, then agent upgrades will be paused for
+all projects within that tenant, and all clusters within those projects. Similarly, if you resume upgrades at the
+project level, then all clusters within that project will have their agent upgrades resumed.


maybe add more, to help clarify:
"If the tenant admin subsequently changes the tenant level setting again, then all projects and clusters will be changed again to match."

antongisli · 2024-09-20T16:10:27Z

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

+all projects within that tenant, and all clusters within those projects. Similarly, if you resume upgrades at the
+project level, then all clusters within that project will have their agent upgrades resumed.
+
+This is a one-time change that happens at the moment when you pause or resume upgrades in the higher scope, and it does


Suggested change

This is a one-time change that happens at the moment when you pause or resume upgrades in the higher scope, and it does

This is a one-time change that happens at the moment when you pause or resume upgrades in the project or tenant scope, and it does

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

antongisli · 2024-09-20T16:12:54Z

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md

+Edge hosts that are part of a cluster have their agent upgrades managed by the settings of their cluster. Edge hosts
+that are not part of a cluster have their agent upgrades managed at the project and tenant level. Similar to clusters,
+pausing or resuming agent upgrades at the tenant level will automatically pause or resume agent upgrades for all
+projects with in that tenant. However, you can override the tenant level setting by manually changing the upgrade


Suggested change

projects with in that tenant. However, you can override the tenant level setting by manually changing the upgrade

projects within that tenant. However, you can override the tenant level setting by manually changing the upgrade

This reverts commit d8eae55.

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

github-actions · 2024-09-20T17:11:52Z

docs/docs-content/security-bulletins/reports/cve-2023-29404.md

+
+## NIST Summary
+
+The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'cgo'?

github-actions · 2024-09-20T17:11:52Z

docs/docs-content/security-bulletins/reports/cve-2023-29404.md

+
+## NIST Summary
+
+The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.ableism] Avoid using ableism terms. Use 'operating' instead of 'running'.

github-actions · 2024-09-20T17:11:52Z

docs/docs-content/security-bulletins/reports/cve-2023-29404.md

+## NIST Summary
+
+The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a
+malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.ableism] Avoid using ableism terms. Use 'operating' instead of 'running'.

github-actions · 2024-09-20T17:11:52Z

docs/docs-content/security-bulletins/reports/cve-2023-29404.md

+malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker
+flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are
+incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects
+usage of both the gc and gccgo compilers.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'gc'?

github-actions · 2024-09-20T17:11:52Z

docs/docs-content/security-bulletins/reports/cve-2023-29404.md

+malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker
+flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are
+incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects
+usage of both the gc and gccgo compilers.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'gccgo'?

github-actions · 2024-09-20T17:11:53Z

docs/docs-content/security-bulletins/reports/cve-2019-8457.md

+
+## Last Update
+
+11/7/2023


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '11/7/2023'.

github-actions · 2024-09-20T17:11:54Z

docs/docs-content/security-bulletins/reports/cve-2019-8457.md

+## NIST Summary
+
+SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when
+handling invalid rtree tables.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'rtree'?

github-actions · 2024-09-20T17:11:54Z

docs/docs-content/security-bulletins/reports/cve-2022-2880.md

+
+## Last Update
+
+11/25/2023


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '11/25/2023'.

github-actions · 2024-09-20T17:11:54Z

docs/docs-content/security-bulletins/reports/cve-2022-2880.md

+
+## NIST Summary
+
+Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'unparsable'?

github-actions · 2024-09-20T17:11:54Z

docs/docs-content/security-bulletins/reports/cve-2022-2880.md

+## NIST Summary
+
+Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable
+parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'HTTP' instead of 'http'.

lennessyy · 2024-09-20T17:33:28Z

Something weird happened with the security bulletin folder so i'm closing this and opening a new PR.

lennessyy added 3 commits September 16, 2024 13:32

docs: clarify how upgrades are evaluated

bcf9582

docs: update image

beaeb6b

docs: add info box for explaining edge case

9bf74c4

lennessyy marked this pull request as ready for review September 16, 2024 20:56

lennessyy requested a review from a team as a code owner September 16, 2024 20:56

lennessyy requested review from karl-cardenas-coding, addetz and caroldelwing September 16, 2024 20:56

lennessyy and others added 3 commits September 16, 2024 13:56

Merge branch 'master' into pause-agent-upgrade

c327849

docs: minor word change

8b4ce07

Optimised images with calibre/image-actions

2fd065d

lennessyy added 2 commits September 16, 2024 14:20

docs: move warning after chart

0b71772

Merge branch 'pause-agent-upgrade' of https://github.com/spectrocloud…

8f92303

…/librarium into pause-agent-upgrade

lennessyy requested a review from antongisli September 16, 2024 21:21

lennessyy and others added 4 commits September 17, 2024 14:02

Merge branch 'master' into pause-agent-upgrade

876b7e9

docs: update upgrade evaluate scheme

a025f24

Merge branch 'pause-agent-upgrade' of https://github.com/spectrocloud…

cd74a8e

…/librarium into pause-agent-upgrade

docs: add a table

406f70f

github-actions bot reviewed Sep 19, 2024

View reviewed changes

docs/docs-content/clusters/cluster-management/platform-settings/pause-platform-upgrades.md Show resolved Hide resolved

lennessyy added 2 commits September 19, 2024 15:36

docs: delete diagram

d8eae55

docs: edit tab titles

6ae76b1

github-actions bot reviewed Sep 20, 2024

View reviewed changes

ci: auto-formatting prettier issues

2243790

github-actions bot reviewed Sep 20, 2024

View reviewed changes

antongisli approved these changes Sep 20, 2024

View reviewed changes

Revert "docs: delete diagram"

1839cfd

This reverts commit d8eae55.

github-actions bot reviewed Sep 20, 2024

View reviewed changes

docs: remove irrelevant files

a71c16f

lennessyy closed this Sep 20, 2024

lennessyy mentioned this pull request Sep 20, 2024

docs: clarify agent upgrade documentation #4031

Merged

1 task


		## Images

		- gcr.io/spectro-images-public/release/kubevirt/virt-handler:v1.2.0


		## NIST Summary

		The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any


		## NIST Summary

		Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead

		@@ -8,11 +8,58 @@ tags: ["clusters", "cluster management"]
		---

		Palette supports the Pause Agent Upgrades feature to exclude a cluster or a group of clusters from getting

	This is a one-time change that happens at the moment when you pause or resume upgrades in the higher scope, and it does
	This is a one-time change that happens at the moment when you pause or resume upgrades in the project or tenant scope, and it does

	projects with in that tenant. However, you can override the tenant level setting by manually changing the upgrade
	projects within that tenant. However, you can override the tenant level setting by manually changing the upgrade


		## NIST Summary

		The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a


		## NIST Summary

		Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable

docs: clarify how upgrades are evaluated #3935

docs: clarify how upgrades are evaluated #3935

Conversation

lennessyy commented Sep 16, 2024 • edited Loading

Describe the Change

Changed Pages

Jira Tickets

Backports

netlify bot commented Sep 16, 2024 • edited Loading

❌ Deploy Preview for docs-spectrocloud failed. Why did it fail? →

vault-token-factory-spectrocloud bot commented Sep 16, 2024

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

antongisli left a comment

Choose a reason for hiding this comment

antongisli Sep 20, 2024

Choose a reason for hiding this comment

antongisli Sep 20, 2024

Choose a reason for hiding this comment

antongisli Sep 20, 2024

Choose a reason for hiding this comment

antongisli Sep 20, 2024

Choose a reason for hiding this comment

antongisli Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

lennessyy commented Sep 16, 2024 •

edited

Loading

netlify bot commented Sep 16, 2024 •

edited

Loading

lennessyy commented Sep 20, 2024 •

edited

Loading