Skip to content

Add sig-security-assessments sub-project #6512

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Add sig-security-assessments sub-project #6512

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions sig-security/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ The Chairs of the SIG run operations and processes governing the SIG.
## Subprojects

The following [subprojects][subproject-definition] are owned by sig-security:
### security-assessments
Security focussed Assessments of Kubernetes Sub-projects
- **Owners:**
- [kubernetes/sig-security/sig-security-assessments](https://github.com/kubernetes/sig-security/blob/main/sig-security-assessments/OWNERS)
- **Contact:**
- Slack: [#sig-security-assess-capi](https://kubernetes.slack.com/messages/sig-security-assess-capi)
Copy link
Member

@tabbysable tabbysable Jun 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feels like it's tying the subproject pretty closely to the history of the CAPI assessment; WDYT about creating a new slack channel for a fresh history and more general focus?.

As we figure out the long-term workflows for self-assessments we can come back and update things as necessary.

Copy link
Member

@mrbobbytables mrbobbytables Jun 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would also +1 avoid tying it directly to capi. If the channel has the right folk in it, could just rename it to be more generic.

Copy link
Contributor

@aladewberry aladewberry Jun 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @tabbysable and @mrbobbytables ! I'll have a look at the slack channel to see its content. If it's general enough, I'll plan to rename. Otherwise I'll make a new one.

If I were to rename the channel, is there a process I need to go through for doing that? Or just rename it and submit a PR to update the README?

Copy link
Member Author

@PushkarJ PushkarJ Jun 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO, new channel (#sig-security-assessments) makes sense since the discussion in current channel was very specific to Cluster API.

That channel can act as root node of security assessments sub-project (from thought exercise perspective) that can branch out to new channels that are project specific. e.g.

sig-security
- sig-security-assessments
-- sig-security-assess-capi
-- sig-security-assess-csi-driver

If we decide to go this route,

Copy link
Contributor

@aladewberry aladewberry Jun 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome - I came to the same conclusion reading the channel on Friday - new channel for the root node! Do I need to get any further approval to go ahead and request the new channel, or just have at it and get it stood up?

Copy link
Contributor

@aladewberry aladewberry Jun 29, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just requested a new channel! #6722

### security-audit
Third Party Security Audit
- **Owners:**
Expand Down
6 changes: 6 additions & 0 deletions sigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2343,6 +2343,12 @@ sigs:
github: parispittman
name: Paris Pittman
subprojects:
- name: security-assessments
description: Security focussed Assessments of Kubernetes Sub-projects
contact:
slack: sig-security-assess-capi
owners:
- https://raw.githubusercontent.com/kubernetes/sig-security/main/sig-security-assessments/OWNERS
- name: security-audit
description: Third Party Security Audit
owners:
Expand Down