Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create a prow job that scans proposed images against vulnerabilities #436

Closed
rikatz opened this issue Oct 29, 2019 · 20 comments
Closed

Create a prow job that scans proposed images against vulnerabilities #436

rikatz opened this issue Oct 29, 2019 · 20 comments
Assignees
@cpanato @hasheddan
Labels
area/artifacts Issues or PRs related to the hosting of release artifacts for subprojects area/release-eng Issues or PRs related to the Release Engineering subproject priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. sig/release Categorizes an issue or PR as relevant to SIG Release.

Comments

@rikatz
Copy link
Contributor

rikatz commented Oct 29, 2019 •
edited
Loading

As talked with @listx on Slack:

It would be interesting to have some sort of Prow job that verifies staging images against vulnerabilities, using GCR Container Analysis or some other tool.

Any image trying a 'promotion' might need to be scanned and only promoted if its vulnerability score is lower than some defined threshold.

Also it would be interesting to have some sort of "Allowed CVE List" to bypass well-known false positives.

Edit: maybe related: kubernetes-sigs/promo-tools#144
@listx
Copy link
Contributor

listx commented Dec 12, 2019

/cc @listx

@rajibmitra
Copy link
Member

rajibmitra commented Feb 29, 2020 •
edited
Loading

/assign rajibmitra

@rajibmitra
Copy link
Member

design doc : https://docs.google.com/document/d/1ps_rgQoK9wsRlFUMKBbAsBNzu5rIqZByDuf3P7KpX7s/edit?ts=5e417965

@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 19, 2020
@listx
Copy link
Contributor

listx commented Jul 24, 2020

/remove-lifecycle stale

@yodahekinsew is working on this.

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 24, 2020
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 23, 2020
@rikatz
Copy link
Contributor Author

rikatz commented Nov 23, 2020

/close

I'm closing this, if this became a problem again I'll open a new discussion

@k8s-ci-robot
Copy link
Contributor

@rikatz: Closing this issue.

In response to this:

/close

I'm closing this, if this became a problem again I'll open a new discussion

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rikatz
Copy link
Contributor Author

rikatz commented Nov 23, 2020

Damn sorry!

I read the wrong issue

/reopen

@k8s-ci-robot
Copy link
Contributor

@rikatz: Reopened this issue.

In response to this:

Damn sorry!

I read the wrong issue

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot reopened this Nov 23, 2020
@rikatz
Copy link
Contributor Author

rikatz commented Nov 23, 2020

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 23, 2020
@rajibmitra rajibmitra removed their assignment Dec 15, 2020
@spiffxp
Copy link
Member

spiffxp commented Jan 21, 2021

/sig release
/area release-eng
/area artifacts
/milestone v1.21
/assign @cpanato @hasheddan
I think we basically have this now, I will defer to @kubernetes/release-engineering whether this can be closed. I would consider gating promotion based on vulns to be a followup issue.

@k8s-ci-robot k8s-ci-robot added sig/release Categorizes an issue or PR as relevant to SIG Release. area/release-eng Issues or PRs related to the Release Engineering subproject area/artifacts Issues or PRs related to the hosting of release artifacts for subprojects labels Jan 21, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.21 milestone Jan 21, 2021
@spiffxp spiffxp added the priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. label Jan 22, 2021
@cpanato
Copy link
Member

cpanato commented Jan 26, 2021

We now have this initial page that shows the vulns for the images we published

https://storage.googleapis.com/k8s-artifacts-prod-vuln-dashboard/dashboard.html

it is not beautiful, but I'm working to make it more "nice" and will open some discussion in RelEng to define the next steps.

/note-myself to add this topic in the RelEng agenda

@spiffxp
Copy link
Member

spiffxp commented Apr 1, 2021

@ameukam asked if we still want this service enabled for staging repos during today's k8s infra meeting

@rikatz
Copy link
Contributor Author

rikatz commented Apr 5, 2021

I'm not sure. IMO it's really important for us to make sure the images we serve (at least the kubernetes one) does not contain any vulnerable package, but I guess it's worth to discuss with sig-security about this.

For other images, this should be an opt-in.

Maybe we should close this, and think from another perspective: does sig-release wants to scan the generated images? If so, instead of relying on GCP costs, maybe add a prow job that downloads the image and runs trivy or some other image scanner for problems, and break the CI if this happens, triggering an alert to update the image.

@IanColdwater @tabbysable I guess it would be good to have some point of view from security here

@spiffxp
Copy link
Member

spiffxp commented Apr 5, 2021

@kubernetes/release-engineering is this part of your v1.22 plans?

@spiffxp
Copy link
Member

spiffxp commented Apr 15, 2021

/remove-milestone

@spiffxp
Copy link
Member

spiffxp commented Apr 15, 2021

/milestone clear

@k8s-ci-robot k8s-ci-robot removed this from the v1.21 milestone Apr 15, 2021
@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 14, 2021
@spiffxp
Copy link
Member

spiffxp commented Jul 16, 2021 •
edited
Loading

/remove-lifecycle stale
/close
We've disabled vulnerability scanning for now: #1963

Can reopen or recreate this issue when we've been able to give this more thought

@spiffxp spiffxp closed this as completed Jul 16, 2021
@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 16, 2021
@rajibmitra rajibmitra mentioned this issue Sep 6, 2021
Closed
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cpanato cpanato

@hasheddan hasheddan

Labels
area/artifacts Issues or PRs related to the hosting of release artifacts for subprojects area/release-eng Issues or PRs related to the Release Engineering subproject priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. sig/release Categorizes an issue or PR as relevant to SIG Release.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
9 participants
@spiffxp @listx @cblecker @rajibmitra @cpanato @rikatz @k8s-ci-robot @fejta-bot @hasheddan