Cluster-API Security Self-Assessment Initiative

[rficcaglia]

This is to consolidate info and inform all the interested folks regarding discussions around security assessment of cluster-api sub-project.

This is our first attempt as a community where a Security SIG will perform a security assessment of a sub-project of a graduated CNCF project. So we expect to make slow but reasonable progress and will be open for feedback on how we can improve for the benefit of others who will follow us.

The first step of a (community driven) security assessment of a project is a self-assessment of the project. Although, this is typical done by the project maintainers, some of us in #sig-security would be happy to take a first crack at filling out the outline template provided by CNCF TAG-Security.

Currently the volunteers are educating themselves on cluster-api docs and presentations and will coordinate with maintainers (who understandably are very busy but are engaged).

Related items:

kubernetes/community#5792

cncf/tag-security#603

https://groups.google.com/g/kubernetes-sig-cluster-lifecycle/c/Fi0UGzfbQfY

[rficcaglia]

EDIT: I guess I messed up the labels so re-commented below.

maybe we should/need to create a wg? @tabbysable @reylejano @PushkarJ ?

[k8s-ci-robot]

@rficcaglia: The label(s) sig/sig-security, sig/cluster-api cannot be applied, because the repository doesn't have them.

In response to this:

/sig sig-security
/sig cluster-api

maybe we should/need to create a wg? @tabbysable @reylejano @PushkarJ ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rficcaglia]

/sig security

[reylejano]

Related issue in cluster-api repo kubernetes-sigs/cluster-api#4446

[neolit123]

maybe we should/need to create a wg?

WGs have a contract with Kubernetes Steering and require a community page, Zoom call slots, Slack channels and yearly status reports. my vote would be to not create WGs for subproject security audits, but if people insist it can be done.

[PushkarJ]

@rficcaglia regarding WG creation, our co-chair @tabbysable PoV is here, which I tend to agree with.

TL;DR this seems like a lower intensity effort that would not require a WG

[PushkarJ]

/sig cluster-lifecycle

[tabbysable]

For the record: this is wonderful, huge thanks to everyone involved.

[rficcaglia]

here's my first pass at the self-assessment outline structure, ie not the CAPI details themselves but the high level parts to be filled in (including a place for someone to fill in the CAPI-specific features and controls). this is meant to be both for CAPI and serve as a template for future subproject use.

https://docs.google.com/document/d/1Fj_cLUN9kLruHbEgmYiEgoqZjf2rRuVOmQDGOKByaf4/edit?usp=sharing

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[PushkarJ]

/remove-lifecycle stale
/transfer sig-security

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[PushkarJ]

/remove-lifecycle stale

[PushkarJ]

Just wanted to leave some updates here for folks who stumble upon this and are wondering what's the current status:

• The group collaborates and meets regularly on sig-security-assess-capi
• The scope is limited to Cluster API AWS provider focussing on two flows: workload control plane node creation and workload control plane node worker node creation
• We conducted data flow diagram exercises across several different meetings in the past few months on these flows
• The data flows along with identified threats are being discussed at the time of writing this update
• We expect that the outcome of the discussion would be a list of Github issues that will enable us to address any identified threats in Cluster API

/assign @rficcaglia @PushkarJ
/sig cluster-lifecycle security

[PushkarJ]

/retitle Cluster-API Security Self-Assessment Initiative

[PushkarJ]

So far as a follow up on the security assessment, the following issues have been created:

• cluster-api/issues/6153
• cluster-api/issues/6329
• cluster-api/issues/6152
• cluster-api/issues/6151

[PushkarJ]

Project tracker to manage completion of identified issues can be found here: https://github.com/orgs/kubernetes/projects/83/views/1