Kubernetes-Security-Slam-2023

[SD-13]

Open tasks for the Kubernetes Security Slam 2023

• Ensure SBOMs are generated by Kubernetes BOM (task 3) @SD-13
• Ensure SLSA Attestations are generated when possible (task 4) @shafeeqes
• Ensure the project has a VEX Feed (task 5) @shafeeqes feat: Initialize OpenVEX feed #2275 feat: Generate OpenVX data for every release #2276
• Add project to CLOMonitor / Run tests for Clomonitor (task 7) @jescalada Onboard Kube State Metrics onto CLOMonitor cncf/clomonitor#1380
• Check for Binary Artifacts (task 8)
• Review the code review (task 9)
• Dangerous Workflow (task 10)
• Security Insights (task 11) @dalehenries chore: add Security Insights (task 11) #2278
• Dependencies policy (task 12)
• Dependency update tool (task 13)
• Token Permissions (task 16) @dalehenries ci: token permissions - security slam task 16 #2279

@puerco

---

Open questions

• feat: Initialize OpenVEX feed #2275 (review)
• docs: add OpenSSF Scorecard to README #2277 (comment)
• Onboard Kube State Metrics onto CLOMonitor cncf/clomonitor#1380 (review)

[mrueg]

/triage accepted

[jescalada]

I'd like to tackle Task 7!

[jescalada]

Please take a look at the CLOMonitor .yaml PR here:
cncf/clomonitor#1380

Thank you!

[SD-13]

Hey @mrueg @dgrisonnet @rexagod I want to know whether kube-state-metrics is generating SBOM as part of the release pipeline. Where to look for the release pipeline?