nnf-cve-cleanup

name	nnf-cve-cleanup
description	Cleans up NNF deployments impacted by vulnerable or outdated container images using guided execution.
lastReviewed	2026-04-30T00:00:00.000Z

NNF CVE Cleanup (Execution Enabled)

This skill remediates S360 / ADO action items like:

• "Cleanup Required: Parallel RP deployments running outdated images"
• "Vulnerable container image reference"
• "CVE in NFC cluster extension images"

Affected components typically include:

• nfarpgatewaymgrworker
• nfarpsouthboundworker
• nfarpjobservice

---

✅ Step 1 — Resolve target (cluster + deployments)

Extract from S360 / ADO text:

• SubscriptionId
• ResourceGroup
• ClusterName (if available)
• Namespace
• Deployment names (nfarp*)

If missing → run resolver:

python scripts/resolve-target.py --text "<paste S360/ADO text>"

---

✅ Step 2 — Execute cleanup

Allowed subscriptions (hard-enforced by script):

• d854f6e5-7f11-4515-9d58-2ef770a77ee2
• 962219bd-33e8-461a-aa01-2ea9236a2b07
• 9531faa8-8c39-4165-b033-48697fe943db
• 89a70903-42a2-4ff6-b437-688a27893711

Choose the appropriate action for your scenario:

Action	When to use
restart (default)	Refresh pods to pull patched images (CVE remediation)
delete	Permanently remove stale/orphaned deployments
scale-down	Scale stale deployments to 0 replicas without deleting

PowerShell:

# Restart pods (CVE image refresh)
scripts/cleanup-deployments.ps1 -SubscriptionId <sub> -ResourceGroup <rg> -ClusterName <cluster> -Namespace <ns> -Deployments "dep1,dep2" -Action restart

# Delete stale deployments
scripts/cleanup-deployments.ps1 -SubscriptionId <sub> -ResourceGroup <rg> -ClusterName <cluster> -Namespace <ns> -Deployments "dep1,dep2" -Action delete

# Scale down to 0 replicas
scripts/cleanup-deployments.ps1 -SubscriptionId <sub> -ResourceGroup <rg> -ClusterName <cluster> -Namespace <ns> -Deployments "dep1,dep2" -Action scale-down

Bash:

# Restart pods (CVE image refresh)
scripts/cleanup-deployments.sh --subscription <sub> --resource-group <rg> --cluster <cluster> --namespace <ns> --deployments "dep1,dep2" --action restart

# Delete stale deployments
scripts/cleanup-deployments.sh --subscription <sub> --resource-group <rg> --cluster <cluster> --namespace <ns> --deployments "dep1,dep2" --action delete

# Scale down to 0 replicas
scripts/cleanup-deployments.sh --subscription <sub> --resource-group <rg> --cluster <cluster> --namespace <ns> --deployments "dep1,dep2" --action scale-down

---

✅ Step 3 — Verify cleanup

kubectl get pods -n kubectl rollout status deployment -n

---

✅ Step 4 — Document results

Capture the following:

Deployment rollout status Pod health output Any errors or warnings

Paste results into:

S360 action item ADO work item

✅ Close the item after successful validation