Kubernetes-Security-Slam-2023

[acumino]

Open tasks for the Kubernetes Security Slam 2023

Release to Community Infrastructure:

• [x] Releases are being made via CI(task1)- Add cloud-build file to manage release via CI #17807 Cloud-Build is for repos that release images, minikube is not a use case for it.
• [x] Check that Images are Staged and Promoted Using Community Infra (task2) Cloud-Build is for repos that release images, minikube is not a use case for it.

Automate Security Documentation:

• Ensure SBOMs are Generated by Kubernetes BOM (task3) @sandipanpanda Add sbom.yml to generate SBOM by Kubernetes BOM #17816
• Ensure SLSA Attestations are Generated when Possible (task4) @acumino
• Ensure the Project has a VEX Feed (task5) Initialize the VEX feed #17809 New workflow which will generate openvex data on each release #17810

CLOMonitor: Secure Development Practices:

• Add OpenSSF badge @acumino Add OpenSSF Scorecard and Best Practice badge in README #17811
  - Pin docker image to commit hash - Pin docker images to commit hash #17813
• Add security-insights.yaml @sandipanpanda Add SECURITY-INSIGHTS.yml #17814
• Add project to CLOMonitor / Run tests for Clomonitor (task 7) @acumino Onboard minikube cncf/clomonitor#1379 Added kubernetes subprojects cncf/clomonitor#1385
• Check for Binary Artifacts (task 8) @acumino (There is only one .iso file used in unit test)Rework test to to remove iso_test.iso #17817
• Review the code review (task 9) @prnvkv All changesets reviewed.
• Docs and Best Practice check @acumino Fix clomonitor checks #17818
• Dangerous Workflow (task 10) @sandipanpanda No dangerous workflow patterns detected.
• Security Insights (task 11) @acumino
• Dependencies policy (task 12) @prnvkv
• Dependency update tool (task 13) @sandipanpanda Dependabot is configured.
• Token Permissions (task 15) @acumino Restrict permission for github token #17812

---

Follow-Ups:

• Fix Generate SBOM workflow #17828

[ArangoGutierrez]

Cloud-Build is for repos that release images, minikube is not a use case for it

[acumino]

The release job is required to generate SBOMs and SLSA for each release. I am not able to find one.
@spowelljr Can you confirm that releases are done manually for minikube?

[acumino]

The release job is required to generate SBOMs and SLSA for each release. I am not able to find one. @spowelljr Can you confirm that releases are done manually for minikube?

/cc @afbjorklund

[acumino]

/assign @acumino @prnvkv @sandipanpanda

[k8s-ci-robot]

@acumino: GitHub didn't allow me to assign the following users: prnvkv.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign @acumino @prnvkv @sandipanpanda

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[spowelljr]

The release job is required to generate SBOMs and SLSA for each release. I am not able to find one. @spowelljr Can you confirm that releases are done manually for minikube?

Releases are currently run manually from a non-publicly accessible Jenkins instance. However we were asked to migrate the release process to a public space by the end of 2024.

[afbjorklund]

This seems like a (rather vague) long-term goal, and you don't need to tag maintainers - until it is actually urgent to do?Otherwise it just seems like another of those drive-by initiatives...

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.