Cluster-API Security Self-Assessment Initiative about sig-security

[PushkarJ]

@rficcaglia regarding WG creation, our co-chair @tabbysable PoV is here, which I tend to agree with.

TL;DR this seems like a lower intensity effort that would not require a WG

[tabbysable]

For the record: this is wonderful, huge thanks to everyone involved.

[PushkarJ]

Just wanted to leave some updates here for folks who stumble upon this and are wondering what's the current status:

• The group collaborates and meets regularly on sig-security-assess-capi
• The scope is limited to Cluster API AWS provider focussing on two flows: workload control plane node creation and workload control plane node worker node creation
• We conducted data flow diagram exercises across several different meetings in the past few months on these flows
• The data flows along with identified threats are being discussed at the time of writing this update
• We expect that the outcome of the discussion would be a list of Github issues that will enable us to address any identified threats in Cluster API

/assign @rficcaglia @PushkarJ
/sig cluster-lifecycle security

[rficcaglia]

EDIT: I guess I messed up the labels so re-commented below.

maybe we should/need to create a wg? @tabbysable @reylejano @PushkarJ ?

[k8s-ci-robot]

@rficcaglia: The label(s) sig/sig-security, sig/cluster-api cannot be applied, because the repository doesn't have them.

In response to this:

/sig sig-security
/sig cluster-api

maybe we should/need to create a wg? @tabbysable @reylejano @PushkarJ ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rficcaglia]

/sig security

[reylejano]

Related issue in cluster-api repo kubernetes-sigs/cluster-api#4446

[neolit123]

maybe we should/need to create a wg?

WGs have a contract with Kubernetes Steering and require a community page, Zoom call slots, Slack channels and yearly status reports. my vote would be to not create WGs for subproject security audits, but if people insist it can be done.

[PushkarJ]

/sig cluster-lifecycle

[rficcaglia]

here's my first pass at the self-assessment outline structure, ie not the CAPI details themselves but the high level parts to be filled in (including a place for someone to fill in the CAPI-specific features and controls). this is meant to be both for CAPI and serve as a template for future subproject use.

https://docs.google.com/document/d/1Fj_cLUN9kLruHbEgmYiEgoqZjf2rRuVOmQDGOKByaf4/edit?usp=sharing

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[PushkarJ]

/remove-lifecycle stale
/transfer sig-security

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[PushkarJ]

/remove-lifecycle stale

[PushkarJ]

/retitle Cluster-API Security Self-Assessment Initiative

[PushkarJ]

So far as a follow up on the security assessment, the following issues have been created:

• cluster-api/issues/6153
• cluster-api/issues/6329
• cluster-api/issues/6152
• cluster-api/issues/6151

[PushkarJ]

Project tracker to manage completion of identified issues can be found here: https://github.com/orgs/kubernetes/projects/83/views/1