Kyverno security self assessment

[JimBugwadia]

cc: @jlk

[JimBugwadia]

Preview at https://github.com/kyverno/tag-security/blob/kyverno-self-assessment/assessments/projects/kyverno/self-assessment.md.

[lumjjb]

This is awesome! We'll do a short "clarifying questions" phase review on this just to clarify on some points (if needed) and we'll can merge it in!

Part of this phase is to do the following:

• Verify completeness
• Ask for clarifications
• Ensure terms are defined
• Ensure concepts introduced are explained with context
• Provide quick feedback

[fkautz]

Please include me

[dutchshark]

interested in helping out.

After a chat with Brandon on this PR - I've read up on https://github.com/cncf/tag-security/blob/main/assessments/guide/self-assessment.md - I'm missing some elements in this one:
Languages which I would address as Go and the SBOM shouldn't this match up with https://kyverno.io/docs/installation/ and the Compatability Matrix?

[dutchshark]

For discussion tonight with @lumjjb:
kyverno/kyverno#2950 (comment) as this would mean vulnerability in their used logger (which should be part of the SBOM) exists two CVE's are hit.

[dutchshark]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[JimBugwadia]

Thanks @dutchshark!

I've read up on https://github.com/cncf/tag-security/blob/main/assessments/guide/self-assessment.md - I'm missing some elements in this one

Are there other sections or information you recommend we add to the self-assessment?

Languages which I would address as Go and the SBOM shouldn't this match up with https://kyverno.io/docs/installation/[](https://github.com/JimBugwadia) and the Compatability Matrix?

Kyverno uses Golang but is delivered as a container image and manifests. The available installation are options are via a Helm chart or YAMLs.

The Security page provides a link to the SBOM. We can reference in the installation as well.

[dutchshark]

You're welcome @JimBugwadia - I'm only here to help;

Are there other sections or information you recommend we add to the self-assessment?

I think the initial self-assessment is providing that what tag-security needs and the more details provided the better. Hence my comments around the adding of the SBOM to your self-assessment.

The Security page provides a link to the SBOM.

If you could put it on your self-assessment that would be great.

[lumjjb]

lgtm , added wesley as another reviewer