[Initiative]: Kyverno Joint Security Assessment

[brandtkeller]

(Note: this was filed with the initiative template and updated to the joint security assessment template on 1 Oct by @evankanderson. Some fields will still need to be filled out.)

Project Name

Kyverno

GitHub URL

https://github.com/kyverno/kyverno

Project Security Contacts

@JimBugwadia , @realshuting

Getting Started

Self Assessment Link

https://github.com/cncf/toc/tree/main/projects/kyverno/security-assessment/self-assessment.md

CNCF Project Stage

Incubation

Security Provider

Yes

Security Review Checklist

• Identify team
  • Project's assessment lead @realshuting / @JimBugwadia
  • Lead security reviewer @sublimino
  • 1 or more additional reviewer(s) @JustinCappos @sunstonesecure-robert @eddie-knight Observers: @jackap @trumant @camilaavilarinho @tturquette
  • Every reviewer has read security reviewer guidelines and stated declaration of conflict
  • Sign off by facilitator on reviewer conflicts
• Create slack channel (e.g. #sec-assess-projectname)
• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review
• Presentation & discussion
• Share draft findings with project
• Assessment summary and doc checked into /projects/project-name/assessments/ (require at least 1 co-chair approval)
• CNCF TOC presentation (if requested by TOC)

[CortNick]

Hi @brandtkeller! Now that the elections for TAG chairs is completed, I wanted to check in with you about this. Is there anything we can/should do on our end to help get this review started?

[eddie-knight]

Some thoughts...

1. I don't anticipate that Brandt has any mechanism to help move this forward or answer questions on it
2. The new TAG Security & Compliance is not yet chartered, and there is not yet clarity on when/how the TAG is able to take action independently of TOC approval
3. This application will require response from the TOC, as they now hold the approval authority for all initiatives

[realshuting]

Hi @eddie-knight, thank you for your input, and thanks to @angellk for assisting with triage. We understand that TAG Security & Compliance is currently undergoing the chartering process. In the meantime, is there any documentation or preparatory work you recommend we begin now to help streamline the upcoming security assessment for Kyverno? Please let us know if there are specific materials or actions we can prioritize.

[JustinCappos]

If you haven't done the self-assessment, please start this. I'd recommend reading this book, which is a lightweight guide to help you get started.

In the meantime, is there any documentation or preparatory work you recommend we begin now to help streamline the upcoming security assessment for Kyverno? Please let us know if there are specific materials or actions we can prioritize.

[eddie-knight]

Reiterating the previous comment, TAG-SC will keep this on our backlog pending action until the self-assessment has been completed.

Interest was expressed by the following folks on the previous issue:

• @sunstonesecure-robert
• @camilaavilarinho
• @zoltani
• @0dd
• @trumant