Add mitigation information label to the linux CPU vulnerabilities metric

[jopelima]

While the CPU vulnerabilities metric has been added in #2721, it's currently not including information regarding the mitigation strategy used for a given vulnerability.

This information can be quite valuable, as oftentimes different mitigation strategies come with a different performance impact.

This commit adds a third label to the cpu_vulnerabilities_info metric, to include the "mitigation" used for a given vulnerability - if a given vulnerability is not affecting a node or the node is still vulnerable, the mitigation is expected to be empty.

[raptorsun]

Hardcoding these mitigation instructions seem too much for a simple node exporter.
I advise that we keep the metrics as simple as metrics, and putting these additional information elsewhere.
For example, we can create an alert for the vulnerbilities and put an instruction into the label of the corresponding alert, here is a good place for it https://github.com/prometheus-operator/kube-prometheus/tree/main/jsonnet/kube-prometheus/components/mixin
Elsewise, we can write a runbook on CPU vulnerbilities in https://github.com/prometheus-operator/runbooks

By externalizing these information, we can easily keep up with future found vulnerbilities without modifying the node exporter code.

[ignatk]

I think the problem here is that many mitigations are partial. Operators/admins will likely look into additional external sources IFF there are no mitigation applied at all. But if there is "some" mitigation applied - people usually ignore it (guilty myself), where as upon a detailed review it may turn out that a particular mitigation does not apply to a particular workload resulting in the workload running insecure.

The idea here is that we want to query if a specific mitigation is applied.

[jopelima]

I would also add that there is no hardcoding of the vulnerabilities we are retrieving mitigation information for: information on the vulnerabilities, mitigation state, and mitigation strategy are being obtained through the procfs exporter (https://github.com/prometheus/procfs/blob/master/sysfs/vulnerability.go), which is piping through the information from the respective sysfs path.

What is hardcoded in this PR is on the testing side, to ensure the metric is working as intended with current vulnerabilities. The actual implementation will keep working irrespective of any changes made to the system vulnerability sysfs entries.

[discordianfish]

LGTM

[SuperQ]

Thanks