[feature request] Add fuzz-testing

[harshitasao]

What would you like to be added:
Fuzz testing or Fuzzing is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.

Integrate the project with OSS-Fuzz by following the instructions here.

Why is this needed:
To increase the security posture of the project.

Part of #1706

Maintainers help is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.

[furykerry]

openkruise is driven by CRD manifests，and crd will be validated by webhook. I am not sure how semi-malformed data can be used to test openkruise, are their any example in related project, e.g. kubernetes project ?

[hantmac]

@furykerry There are CNCF fuzzzing projects in https://github.com/cncf/cncf-fuzzing and kubernetes also has its fuzzing tests https://github.com/kubernetes/kubernetes/blob/master/pkg/api/testing/fuzzer.go.

I would like to try to use OSS-Fuzz to establish a continuous fuzzing set up for kruise.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[furykerry]

following feature can benefits from fuzz-testing

• Workloadspread/united-deployment subset customization
• Resourcedistribution resource validation
• Sidecarset inject pod metadata

[ggold7046]

@harshitasao , Could you let me know the last date for application and how is the selection procedure for the same ?

[7h3-3mp7y-m4n]

Hey, I just came across this and found it a great opportunity to contribute to Kruise. If there are any follow-up tasks, I’d love to take a look at them. Thanks!

[inosmeet]

Hi @furykerry! @zmberg!

I’m really interested in contributing to this project and would love to be a part of integrating fuzz testing into the LFX project. I have prior experience with fuzz testing, particularly from my work during GSoC’24 with the cve-bin-tool, where I focused on identifying vulnerabilities using similar techniques.

I’ve gone through the OSS-Fuzz integration instructions and am excited to help implement this to enhance the security posture of the project. Could you please let me know if there are any pre-tests or prerequisites that I should be aware of before applying?

Looking forward to discussing this further!