✨ feat(schema): add optional mission.security field, populate install-kubevirt by clubanderson · Pull Request #2027 · kubestellar/console-kb

clubanderson · 2026-04-15T19:06:05Z

Summary

Introduces an optional `security` array in the `kc-mission-v1` schema, alongside the existing `steps` / `uninstall` / `upgrade` / `troubleshooting` arrays. Each entry follows the same `{ title, description }` shape, so the console's existing `StepCard` component can render it unchanged.

No scanner or build-index changes were needed — the field is transparently handled by the existing JSON flow (`build-index.mjs` only indexes top-level metadata; `scanner.mjs` operates on all string values regardless of field name). Backwards-compatible: missions without a `security` field continue to parse and render cleanly.

Populated mission: install-kubevirt.json

Six realistic security bullets as the first proof-of-concept, chosen because KubeVirt is one of the more security-sensitive installs in the catalog:

Cluster-scoped changes — CRDs, ClusterRoles/Bindings, ValidatingWebhookConfiguration created by the operator manifest
Privileged DaemonSet and host access — virt-handler needs `/dev/kvm`, kubelet dir, container runtime socket; Pod Security Admission `restricted` profile caveat with explicit namespace-label workaround
API server `--allow-privileged=true` requirement — why it's needed, which distros have it by default
Hardening: run virtctl with scoped RBAC, not cluster-admin — how to grant only VM verbs (`virtualmachines/start`, etc.) scoped to a namespace
No `/dev/kvm`? Emulation mode is slow but contained — `spec.configuration.developerConfiguration.useEmulation: true` for dev/test and air-gapped environments
Upstream security policy — link to `kubevirt/SECURITY.md` and the `kubevirt-security` advisory list

Context

Paired with two kubestellar/console UI PRs landing in parallel:

SetupInstructionsDialog Security section — surfaces the console's own security posture in the install modal
MissionDetailView Security tab — renders `mission.security` as a new 5th tab (`install | uninstall | upgrade | troubleshooting | security`), with a fallback link to `docs/security/SECURITY-MODEL.md` when a mission has no security content yet

This PR is the data contract that the tab UI consumes. When `mission.security` is empty, the tab shows a "no mission-specific notes yet" state with a link to the overall security doc — so even missions without populated security content are useful.

Follow-up missions to populate next

In order of recent engagement:

install-chaos-mesh (privileged chaos-daemon DaemonSet, host-path socket mounts per runtime, safe-mode flag)
install-kestra (dind sidecar privileged by default, H2 ephemeral vs external Postgres)
install-modelpack-csi-driver (CSI driver runs as privileged DaemonSet)
install-opencost (relatively unprivileged, but note Prometheus data access + optional cloud-provider credentials)
install-longhorn (node-level storage, host filesystem access, privileged instance-manager)

Test plan

JSON parses and security has 6 steps
Scanner regex (``/`[^\`](?:\$\(|;|&&|\|\|)[^\`]`/g``) returns zero hits locally — no false positives from the new content
No banned patterns (`rm -rf`, `delete crd --all`, `--all-namespaces`)
After merge, verify https://console.kubestellar.io/missions/install-kubevirt renders the new Security tab once the console UI PR lands

…-kubevirt Introduces an optional `security` array in the kc-mission-v1 schema alongside the existing `steps` / `uninstall` / `upgrade` / `troubleshooting` arrays. Each entry follows the same shape (`title` + `description`) so the console can render it with the existing StepCard component — no schema/scanner/build-index changes needed; the field is transparently handled by the existing JSON flow. Populates the first mission — install-kubevirt — with six realistic security bullets: 1. Cluster-scoped changes (CRDs, ClusterRoles, webhooks) 2. Privileged DaemonSet and host access (virt-handler, /dev/kvm, kubelet dir, Pod Security Admission caveat) 3. API server --allow-privileged=true requirement 4. Hardening: run virtctl with scoped RBAC, not cluster-admin 5. No /dev/kvm — emulation mode is slow but contained 6. Upstream security policy link This is the data contract for the UI Security tab work landing in kubestellar/console (SetupInstructionsDialog Security section + MissionDetailView Security tab). When `mission.security` is empty, the UI falls back to a link pointing at the overall docs/security/SECURITY-MODEL.md doc in the console repo. Follow-up missions to populate next (in order of recent engagement): install-chaos-mesh, install-kestra, install-modelpack-csi-driver, install-opencost, install-longhorn. Signed-off-by: Andrew Anderson <[email protected]>

kubestellar-prow · 2026-04-15T19:06:10Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2026-04-15T19:06:27Z

🔍 Mission Scan Results

📄 `fixes/cncf-install/install-kubevirt.json`

✅ Schema: Valid kc-mission-v1

✅ Sensitive data: None detected

✅ Security: No malicious content detected

…detail Makes the security picture visible in-context at the two moments users care about — installing the Console itself and installing a CNCF project via a guided mission. Both surfaces link to the SECURITY-MODEL.md doc merged in #8203. Setup install modal (SetupInstructionsDialog.tsx): - New expandable "Security posture" section next to the Dev Guide / K8s Deploy / OAuth sections - Four subsections covering kc-agent posture, AI key handling, what leaves your machine, and the air-gapped / local-LLM option (framed as a security posture, not a feature gap — deliberately scoped to NOT conflate with the separate broader local-LLM support work) - "Read the full security model" link to docs/security/SECURITY-MODEL.md Mission Detail view (MissionDetailView.tsx): - New 5th tab: install / uninstall / upgrade / troubleshooting / **security** - Renders mission.security steps via the existing StepCard component - When mission.security is populated, adds a footer link to the overall SECURITY-MODEL.md so users always have a path to the full doc - When mission.security is empty, shows a helpful fallback with the global doc link and an "Suggest security notes" button (reuses the existing onImprove flow) Schema (lib/missions/types.ts): - Adds optional `security?: MissionStep[]` to the MissionExport interface. Backwards-compatible. Locale (locales/en/common.json): - Adds `missions.detail.tabs.security` and `missions.detail.tabs.securityEmpty` strings Paired with kubestellar/console-kb#2027 which introduces the schema-side `mission.security` array and populates the first mission (install-kubevirt). Signed-off-by: Andrew Anderson <[email protected]>

github-actions · 2026-04-15T19:11:21Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

…detail (#8210) Makes the security picture visible in-context at the two moments users care about — installing the Console itself and installing a CNCF project via a guided mission. Both surfaces link to the SECURITY-MODEL.md doc merged in #8203. Setup install modal (SetupInstructionsDialog.tsx): - New expandable "Security posture" section next to the Dev Guide / K8s Deploy / OAuth sections - Four subsections covering kc-agent posture, AI key handling, what leaves your machine, and the air-gapped / local-LLM option (framed as a security posture, not a feature gap — deliberately scoped to NOT conflate with the separate broader local-LLM support work) - "Read the full security model" link to docs/security/SECURITY-MODEL.md Mission Detail view (MissionDetailView.tsx): - New 5th tab: install / uninstall / upgrade / troubleshooting / **security** - Renders mission.security steps via the existing StepCard component - When mission.security is populated, adds a footer link to the overall SECURITY-MODEL.md so users always have a path to the full doc - When mission.security is empty, shows a helpful fallback with the global doc link and an "Suggest security notes" button (reuses the existing onImprove flow) Schema (lib/missions/types.ts): - Adds optional `security?: MissionStep[]` to the MissionExport interface. Backwards-compatible. Locale (locales/en/common.json): - Adds `missions.detail.tabs.security` and `missions.detail.tabs.securityEmpty` strings Paired with kubestellar/console-kb#2027 which introduces the schema-side `mission.security` array and populates the first mission (install-kubevirt). Signed-off-by: Andrew Anderson <[email protected]>

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 15, 2026

kubestellar-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Apr 15, 2026

clubanderson mentioned this pull request Apr 15, 2026

✨ feat(security): add Security surfaces to install modal and mission detail kubestellar/console#8210

Merged

4 tasks

clubanderson merged commit c5fc7a3 into master Apr 15, 2026
11 of 12 checks passed

clubanderson deleted the feat/security-field-schema branch April 15, 2026 19:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ feat(schema): add optional mission.security field, populate install-kubevirt#2027

✨ feat(schema): add optional mission.security field, populate install-kubevirt#2027
clubanderson merged 1 commit intomasterfrom
feat/security-field-schema

clubanderson commented Apr 15, 2026

Uh oh!

kubestellar-prow Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

clubanderson commented Apr 15, 2026

Summary

Populated mission: install-kubevirt.json

Context

Follow-up missions to populate next

Test plan

Uh oh!

kubestellar-prow Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

🔍 Mission Scan Results

📄 fixes/cncf-install/install-kubevirt.json

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

📄 `fixes/cncf-install/install-kubevirt.json`