[Assessment] Argo

[hblixt]

Project Name: Argo

Github URL: https://github.com/argoproj

cncf/toc#299 (Incubation)
cncf/toc#604 (Graduation - in process)

Self Assessments:
Argo CD
Argo Rollouts
Argo Workflows
Argo Events

Security Provider: No

• Identify team
  • Project security lead - @jannfis
  • Project assessment facilitator - @IAXES
  • Lead security reviewer @jlk @IAXES
  • 1 or more additional reviewer(s) @apmarshall @moswil @hyakuhei @nadgowdas @ashutosh-narkar
  • Every reviewer has read security reviewer guidelines and stated declaration of conflict
  • Sign off by 2 chairs on reviewer conflicts - @lumjjb no need for 2 chairs since no reviewer conflicts
  • Create slack channel ( #sec-assessment-argo)
    Argo CD
• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review

Argo Workflows

• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review

Argo Rollouts

• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review

Argo Events

• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review

Joint Review

• Project lead provides draft document - see outline
• Share draft findings with project
• Presentation & discussion
• Assessment summary and doc checked into /assessments/projects/project-name (require at least 1 co-chair approval)
• CNCF TOC presentation (if requested by TOC)

[sbose78]

👍 from Red Hat.

[lumjjb]

Thanks for opening this issue up! We will process this when we have our intake prioritization review, which should be soon.. But looks likely to be scheduled after cloud custodian review, which will be about the Sep/Oct timeframe!

@ashutosh-narkar @IAXES

[IAXES]

Good day @hblixt , @sbose78 ;

If we have any questions with respect to the self-assessment (and associated documentation), should I reach out to both of you (i.e. via the CNCF Slack instance or this ticket), or are there additional team members we should include?

I've gone ahead and created a dedicated channel, sec-assessment-argo, although it won't be actively used until the assessment commences in the timeframe @lumjjb noted above.

Good to meet you!

[jlk]

I'd be open to lead this one

[nadgowdas]

Interested to help on this

[apmarshall]

Interested in helping on this

[ashutosh-narkar]

Thanks for your interest in being part of the review team. It would be great if y'all and any other folks interested to be part of the review team state their conflict of interest. Thanks!

[apmarshall]

Here's me:

Conflict of interest statement template:

Hard Conflicts	Y/N
Reviewer is a currently a maintainer of the project	N
Reviewer is direct report of/to a current maintainer of the project	N
Reviewer is paid to work on the project	N
Reviewer has significant financial interest directly ties to the success of the project	N

Soft Conflicts	Y/N
Reviewer belongs to the same company/organization of the project, but does not work on the project	(Does CNCF count?)
Reviewer uses the project in their work	N
Reviewer has contributed to the project	N
Reviewer has a personal stake in the project (personal relationships, etc.)	N

[IAXES]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

• Matthew

[sbose78]

@IAXES Greetings!

Could you please include @jannfis ( Jann Fischer, Red Hat ) in your list of primary folks to reach out to.

[jannfis]

Hey, happy to support this from the Argo CD side 👍

[jlk]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO - but my previous employer did an integration w/ Argo. I was not involved.
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[IAXES]

Good day,

Just a heads-up to the Argo team and their reps: I'm aiming to start assembling reviewers mid-September. I expect it to be a busy time with Kubecon approaching in October.

In case anyone hasn't already joined: I'll be using the Slack channel as the primary means of communication (https://cloud-native.slack.com/archives/C029KLSQBD2). I have also put together a private Google group (i.e. mailing list) as a fallback means of communication (typically everything is done through Slack, but if we need to schedule a meeting on short notice through a tool like Doodle, for example, I'll make a point of mentioning it both via Slack and the mailing list). The mailing list will be posted in the Slack channel and anyone that wants to join just needs to ping me via Slack.

Have a great week!

[moswil]

Interested to help.

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO - but my previous employer did an integration w/ Argo. I was not involved.
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[hyakuhei]

I'm super happy to help with the review

[IAXES]

+CC: @ashutosh-narkar @lumjjb @rficcaglia

Good day everyone,

Hope Kubecon went well for everyone! Calling out for security reviewers and security review leads for the Argo assessment. I'll also forward this to Brandon and Ash to relay during our Wednesday meeting (I'm unfortunately unable to attend said meetings at the moment due to a recurring scheduling conflict).

[IAXES]

Good day,

Here's the dedicated Slack channel for the assessment: #sec-assessment-argo (https://cloud-native.slack.com/archives/C029KLSQBD2). Could everyone that plans to take part in the assessment (i.e. security assessors, security assessment lead, etc.) please register with Slack (if not already registered) and join this channel?

• Have conflict of interest disclosure and added to Slack channel:
  • @jlk @apmarshall
• Have conflict of interest disclosure; still needs to join Slack channel:
  • @moswil
• Added to slack channel; still needs to submit conflict of interest disclosure in this Github issue:
  • @nadgowdas
• Need the conflict of interest disclosure and to join the Slack channel:
  • @hyakuhei

Once we've wrapped up the COI disclosures and have everyone added to the Slack channel, we can setup some last-minute details (i.e. any additional contact details needed, how meetings will be scheduled, etc.), and we can get this underway.

Thank you to our security assessors and leads!

Edit: reviewers also need to go over this document prior to concluding the COI signoff/disclosure: https://github.com/cncf/tag-security/blob/main/assessments/guide/security-reviewer.md

[nadgowdas]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO - but my previous employer did an integration w/ Argo. I was not involved.
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[moswil]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO - but my previous employer did an integration w/ Argo. I was not involved.
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[IAXES]

Thanks everyone! Updating the list:

• Have conflict of interest disclosure and added to Slack channel:
  • @jlk @apmarshall @nadgowdas
• Have conflict of interest disclosure; still needs to join Slack channel:
  • @moswil
• Need the conflict of interest disclosure and to join the Slack channel:
  • @hyakuhei

@moswil When time permits, could you please join the #sec-assessment-argo channel in Slack? We'll use it for a lot of correspondence going forward.

Now to get things in motion: @jlk @apmarshall @nadgowdas @moswil Is there any preference for a live meeting (i.e. I throw together a Doodle invite to see if I can get a good meeting time going to setup the team structure, depending on the time zones and schedule of everyone, or shall we just proceed asynchronously via Slack)? Once that's in place, the security lead plus security reviewers can take over from there. :)

[hyakuhei]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO - I'm sure someone somewhere in Amazon might use it but I have no knowledge of such use and am not influence by it.
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[lumjjb]

Chair approval for @jlk to co-lead with @IAXES 👍

[lumjjb]

Chair sign off for conflict of interest

[jlk]

For those not watching Slack - we're doing the first call for the group this Thursday at 7AM Pacific Time.

[IAXES]

I have never reviewed before but I wanted to sign up to be a shadow reviewer.

Hard conflicts: Reviewer is a maintainer of the project - NO Reviewer is a direct report of/to a maintainer of the project - NO Reviewer is paid to work on the project -NO Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts: Reviewer belongs to the same company/organization of the project, but does not work on the project - NO Reviewer uses the project in his/her work - NO Reviewer has contributed to the project. - NO Reviewer has a personal stake in the project (personal relationships, etc.) - NO

Excellent: welcome aboard.

You can find us in the assessment's Slack channel.

[IAXES]

Hi team, I've never performed a security review before but I'd like to help as a shadow reviewer

Hard conflicts: Reviewer is a maintainer of the project - NO Reviewer is a direct report of/to a maintainer of the project - NO Reviewer is paid to work on the project - NO Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts: Reviewer belongs to the same company/organization of the project, but does not work on the project - NO Reviewer uses the project in his/her work - NO Reviewer has contributed to the project. - NO Reviewer has a personal stake in the project (personal relationships, etc.) - NO

Excellent: welcome aboard!

You can find us in the assessment's Slack channel. Please feel free to reach out to me on Slack or via the assessment channel with any questions.

[IAXES]

Hi team, I've never performed a security review before but I'd like to help

Hard conflicts: Reviewer is a maintainer of the project - NO Reviewer is a direct report of/to a maintainer of the project - NO Reviewer is paid to work on the project - NO Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts: Reviewer belongs to the same company/organization of the project, but does not work on the project - NO Reviewer uses the project in his/her work - NO Reviewer has contributed to the project. - NO Reviewer has a personal stake in the project (personal relationships, etc.) - NO

Excellent: welcome aboard!

You can find us in the assessment's Slack channel. Please feel free to reach out to me on Slack or via the assessment channel with any questions.

[IAXES]

Great: 2 additional reviewers + 2 additional shadow reviewers. In addition to the assessment channel link I've noted above, you can also find me via "Matthew Giassa" in the CNCF Slack if you have any 1:1 questions.

Cheers!

[lumjjb]

chair sign off on conflict statements

[dutchshark]

@lumjjb - After our chat - just about an hour ago:

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[IAXES]

+CC: @raesene

Hi Rory,

When time permits, could you please also fill out one of the conflict-of-interest sign-offs (examples above).

Thank you.

[raesene]

@IAXES

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[hblixt]

A quick sign of life...
Work on the assessment took off again after some good discussions at KubeCon Detroit and representatives from the TAG and project are working closely together on closing out the threat modeling and completing the joint assessment, with the goal of having this wrapped early in the new year.

[sunstonesecure-robert]

A little late in the process - but if you need extra help:

Conflict of interest statement template:

Hard Conflicts	Y/N
Reviewer is a currently a maintainer of the project	N
Reviewer is direct report of/to a current maintainer of the project	N
Reviewer is paid to work on the project	N
Reviewer has significant financial interest directly ties to the success of the project	N

Soft Conflicts	Y/N
Reviewer belongs to the same company/organization of the project, but does not work on the project	N
Reviewer uses the project in their work	Maybe - not yet :)
Reviewer has contributed to the project	N
Reviewer has a personal stake in the project (personal relationships, etc.)	N

[IAXES]

@hblixt That's awesome to hear! Thanks for the heads-up.

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[JustinCappos]

@IAXES What is the current status here? I met and worked with the folks in Detroit and see the links above to the self assessments. However, there is no activity in the slack channel since March 3rd.

@jannfis Are you still interested in this completing? I can find folks to push this along and get this to the finish line. I wanted to check there is interest and energy from your side first though.

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[JustinCappos]

Closed due to lack of response.