# Implementing the Auto-refreshing Official Kubernetes CVE Feed

DevFeed: [Implementing the Auto-refreshing Official Kubernetes CVE Feed](<https://devfeed.tech/articles/implementing-the-auto-refreshing-official-kubernetes-cve-feed-17555.md>)

Original publisher: [Read original article](<https://www.kubernetes.dev/blog/2022/09/12/k8s-cve-feed-alpha/>)

Author: The Kubernetes Authors

Published: 2022-09-12T00:00:00Z

Content type: article

Language: en

Sources: [Kubernetes Contributors Blog](<https://devfeed.tech/sources/kubernetes-contributors-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [GitHub Issues](<https://devfeed.tech/topics/github-issues.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [REST API](<https://devfeed.tech/topics/rest-api.md>), [Google Cloud Platform (GCP)](<https://devfeed.tech/topics/google-cloud.md>), [JSON Feed](<https://devfeed.tech/topics/json-feed.md>), [Netlify](<https://devfeed.tech/topics/netlify.md>), [Markdown](<https://devfeed.tech/topics/markdown.md>)

Tags: [cve](<https://devfeed.tech/tags/cve.md>), [github](<https://devfeed.tech/tags/github.md>), [github-issues](<https://devfeed.tech/tags/github-issues.md>), [google-cloud](<https://devfeed.tech/tags/google-cloud.md>), [json](<https://devfeed.tech/tags/json.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [markdown](<https://devfeed.tech/tags/markdown.md>), [netlify](<https://devfeed.tech/tags/netlify.md>), [rest-api](<https://devfeed.tech/tags/rest-api.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article explains how Kubernetes implemented an official, auto-refreshing CVE feed. The system identifies relevant GitHub Issues, periodically retrieves them through the GitHub REST API, stores the data in a Google Cloud Bucket, and publishes JSON Feed and Markdown representations.

## Source excerpt

Author: Pushkar Joglekar (VMware) Accompanying the release of Kubernetes v1.25, we announced availability of an official CVE feed as an alpha feature. This blog will cover how we implemented this feature. Implementation Details An auto-refreshing CVE feed allows users and implementers to programmatically fetch the list of CVEs announced by the Kubernetes SRC (Security Response Committee). To ensure freshness and minimal maintainer overhead, the feed updates automatically by fetching the CVE related information from the CVE announcement GitHub Issues. Creating these issues is already part of the existing Security Response Committee (SRC) workflow. Pre-requisites Until December 2021, it was not possible to filter for issues or PRs that are tied to CVEs announced by Kubernetes SRC. We added a new label, official-cve-feed to address that, and SIG-Security labelled relevant issues with it. The in-scope issues are closed issues for which there is a CVE ID(s) and is officially announced as a Kubernetes security vulnerability by SRC. You can now filter on all of these issues and find them here . For future security vulnerabilities, we added the label to the SRC playbook so that all the future in-scope issues will automatically have this label. Building on existing tooling For the next step, we created a prow job in order to periodically query the GitHub REST API and pull the relevant issues. The job runs every two hours and pushes the CVE related information fetched from GitHub into a Google Cloud Bucket. For every website build (at least twice a day), Netlify data templates make a call to this Google Cloud Bucket to pull the CVE information and then parses into fields that are JSON Feed v1.1 compliant. The JSON file is available for programmatic consumption by automated security tools. For humans, the JSON also gets transformed into a Markdown table for easy viewing. Design Considerations Building trust and ensuring that the feed is not stale were our main priorities when