[Umbrella] Security Assessment Process for Kubernetes sub-projects

[PushkarJ]

Goal: Define, execute and improve on a community driven security assessment process for kubernetes sub-projects, which is self-service and welcomes beginners without prior security background to engage and contribute

Background

CNCF TAG Security has a well established process for project maintainers to engage them in a security review process. However, typically the scope is limited to CNCF projects not sub-projects of graduated projects like Kubernetes. In case of Kubernetes, SIG Security is taking up this responsibility to work within the project community through self-assessments as a partnership between maintainers and SIG Security Members

Scope

• Identify first project as a pilot for this process (Cluster API): Cluster API Security Self Assessment #40
• Create a draft template for self-assessment and gather feedback (Self-Assessment Template)
• Publish draft template after incorporating feedback, in markdown under kubernetes/sig-security
• Publish a task list that covers the entire security assessment process (channel creation, identifying contributors, presenting and resolving findings, etc.): https://github.com/kubernetes/sig-security/blob/main/sig-security-assessments/Documentation/recipe-book.md
• Create label area/security-assessment to allow filtering of these requests (Add new label for security assessments test-infra#23070)
• Create a Github Issue Template to allow anyone to request a security assessment for a sub-project (Create new github issue template for security assessments community#5922)
• Perform retrospective on the process and identify improvements after every assessment: Retrospective of the Security Self-Assessment Subproject Pilot cncf/tag-security#957

Related Issues

Cluster API pilot discussion: cncf/tag-security#603
Cluster API tracker: https://github.com/kubernetes/community/issues/5814
Admission controller: cncf/tag-security#731

/assign @PushkarJ
cc @rficcaglia @reylejano @savitharaghunathan @kubernetes/sig-security-leads
/sig security

[PushkarJ]

/transfer sig-security

[PushkarJ]

/area security-assessment

(Trying out the new label that was merged today)

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[PushkarJ]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[reylejano]

/remove-lifecycle stale

[PushkarJ]

/unassign
/assign aladewberry

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[reylejano]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[reylejano]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[reylejano]

/remove-lifecycle rotten

[PushkarJ]

@aladewberry I updated the description to cover links to all the tasks in the list and marked them as done. Since we have a new sub-project that is going places and making things secure, the issue has served its purpose.

So, I am closing this issue since we can track future self-assessments through their own issues like you are already doing for vsphere-csi-driver #21 and #40 for cluser-api

Feel free to re-open if you disagree :) (Just doing this as part of backlog clearing on my end)