1. Collects the distinct OS image digests reported in device status across enrolled devices.
2. Queries the Red Hat Trusted Profile Analyzer /api/v2/vulnerability/analyze endpoint for each digest.
3. Stores the results in the Red Hat Edge Manager database, keyed by image digest and CVE ID.

Procedure

1. Set vulnerabilityReporting.enabled to true in your Red Hat Edge Manager Helm release values. Merge the following example with your existing configuration:

   vulnerabilityReporting Helm values

   vulnerabilityReporting:
     enabled: true
     syncInterval: "15m"
     trustify:
       endpoint: "https://rhtpa.example.com"
       auth:
         mode: "none"

   Copy code to clipboard

2. If Red Hat Trusted Profile Analyzer uses OAuth2 client credentials, set auth.mode to client-credentials, set oidcIssuerUrl, and reference a Kubernetes secret for the client ID and secret:

   vulnerabilityReporting:
     enabled: true
     syncInterval: "15m"
     trustify:
       endpoint: "https://rhtpa.example.com"
       auth:
         mode: "client-credentials"
         oidcIssuerUrl: "https://sso.example.com/realms/rhtpa"
         secretName: "rhtpa-credentials"

   Copy code to clipboard

3. Create the secret in the same namespace as the Red Hat Edge Manager release before you upgrade:

   $ kubectl create secret generic rhtpa-credentials \
     --from-literal=client_id=<client_id> \
     --from-literal=client_secret=<client_secret> \
     -n <namespace>

   Copy code to clipboard
4. Upgrade the Helm release so flightctl-periodic loads the new configuration. The Red Hat Trusted Profile Analyzer credentials secret is mounted only into the periodic service pod.

Procedure

1. Edit /etc/flightctl/service-config.yaml and set the vulnerabilityReporting block:

   vulnerabilityReporting:
     enabled: true
     syncInterval: 15m
     trustify:
       endpoint: https://rhtpa.example.com
       auth:
         mode: client-credentials
         oidcIssuerUrl: https://sso.example.com/realms/rhtpa
         clientId: <client_id>
         clientSecret: <client_secret>

   Copy code to clipboard
   Important

   Avoid storing client secrets in plain text in production. Prefer environment variable overrides described in Configuration reference.

2. Restart the periodic service:

   $ sudo systemctl restart flightctl-periodic.service

   Copy code to clipboard

Verification

1. Confirm flightctl-periodic logs contain vulnerability-sync entries after the sync interval elapses.
2. Run flightctl get vuln --summary-only after devices report an imageDigest and Red Hat Trusted Profile Analyzer has data for those digests.

Procedure

1. In the navigation menu, open Overview.
2. On the Overview dashboard, review the Security overview card. It shows the total number of active vulnerabilities and a short description that CVEs affect images deployed across your managed fleets and devices.
3. In the card, review the count for each severity band: Critical, Important, Moderate, Low, None, and Undefined.
4. To open the full CVE list, click View all CVEs in the card header.
5. On the Security overview page, review the paginated CVE table. The table lists Name, Severity, Affected devices, and Affected images for each CVE. CVEs are sorted by severity, with Critical listed first.
6. Use Filter by severity or Find by name to narrow the list. Sort columns or move between pages as needed.
7. Click a CVE Name to open the CVE details panel for that CVE.

Procedure

1. Open Devices and select a device to open the device details page.
2. On the device details page, review the Security overview card. It shows a paginated table of CVEs affecting the device for the image digest the device reports. Filter by severity or CVE ID and sort columns as on other vulnerability pages.
3. To review a single CVE in the context of the device, click a CVE row.

Procedure

1. Review the CVE header, published date, and description.
2. Review Severity and Scanner name (findings are sourced from Red Hat Trusted Profile Analyzer).
3. In Affected images, review the image references that carry this CVE.
4. In the Impact summary section, review how many devices and fleets run affected images. The summary table lists Fleet name, Affected devices, and Affected images per fleet. Devices without a fleet owner appear under None.
5. In References, follow links to related Red Hat security advisories when they are available.
6. Click a fleet name to open that fleet’s vulnerability view and see CVEs affecting the fleet.
7. Click the number of affected devices for a fleet to open the Devices list with those devices pre-filtered.
8. For devices without a fleet owner, click the affected device count in the None row to open the Devices list with those devices pre-filtered.

Procedure

1. Open Fleets and select a fleet, or from the Impact summary in a CVE details panel, click a fleet name.
2. On the fleet details page, review the Security overview card. It shows a paginated table of CVEs affecting that fleet only. Filter by severity or CVE ID and sort columns as on other vulnerability pages.

3. To review a single CVE in the context of the fleet, click a CVE row.

   When you plan remediation, distinguish fleet-managed devices from devices without a fleet owner. Use the pre-filtered Devices list from the Impact summary in the CVE details panel to reach affected devices in the None row; update those devices individually or assign them to a fleet.