search

kubernetes-sigs / cluster-api

Home for Cluster API, a subproject of sig-cluster-lifecycle
https://cluster-api.sigs.k8s.io
Apache License 2.0
3.49k stars 1.29k forks source link

Security Self Assessment: [DEV-2] Verify vulnerability reporting process #5398

Closed randomvariable closed 4 months ago

randomvariable commented 2 years ago

Detailed Description

As part of the security self-assessment, (#4446) am reviewing our software development practices.

We have a SECURITY_CONTACTS and we have vulnerability reporting (via an org template?) that can be invoked hitting New Issue.

Do we know if this process is valid for subprojects? In addition, the SECURITY_CONTACTS file is outdated, and needs updating.

(I would also like to volunteer to be on that list)

/kind feature /area security

k8s-ci-robot commented 2 years ago

@randomvariable: The label(s) area/security cannot be applied, because the repository doesn't have them.

In response to [this](https://github.com/kubernetes-sigs/cluster-api/issues/5398): > > >**Detailed Description** > >As part of the [security self-assessment](https://docs.google.com/document/d/1Fj_cLUN9kLruHbEgmYiEgoqZjf2rRuVOmQDGOKByaf4/edit), am reviewing our software development practices. > >We have a SECURITY_CONTACTS and we have vulnerability reporting (via an org template?) that can be invoked hitting New Issue. > >Do we know if this process is valid for subprojects? In addition, the SECURITY_CONTACTS file is outdated, and needs updating. > >(I would also like to volunteer to be on that list) > >/kind feature >/area security Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
neolit123 commented 2 years ago

The process of batch removing these files went stale. But they are pretty much pending deletion in all repos...I'd probably delete the file and keep email / contacts in the main readme.

Girhub handles are useless as there are no github dms?

randomvariable commented 2 years ago

Github handles are useless as there are no github dms?

Yes, I don't think we can use them really for private disclosure.

vincepri commented 2 years ago

/milestone Next

To discuss at SIG level as well + documentation changes and potential issue template

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

fabriziopandini commented 2 years ago

/remove-lifecycle stale

sbueringer commented 2 years ago

/milestone v1.2

PushkarJ commented 2 years ago

/retitle Security Self Assessment: [DEV-2] Verify vulnerability reporting process /sig security /area security

(This topic is being discussed in the community right now across SIG Security, Contribex and SRC. Cluster API sub-project may end up benefitting from the structural changes that this discussion creates)

fabriziopandini commented 1 year ago

/triage accepted

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

fabriziopandini commented 1 year ago

/lifecycle frozen This has been discussed at KubeCon Detroit during a postmortem of the security assessment.

TL;DR; The CAPI subproject doesn't have the critical mass to own its own vulnerability reporting process; in the issue templates, under "Report a security vulnerability" we are referring to the Kubernetes process described in https://github.com/kubernetes-sigs/cluster-api/security/policy, but the Kubernetes security response team should be staffed/define its own processes about how to engage sub-projects. cc @PushkarJ @ aladewberry

sbueringer commented 1 year ago

cc @aladewberry (looks like there is a space too much in your mention)

k8s-triage-robot commented 7 months ago

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

fabriziopandini commented 4 months ago

/priority backlog

fabriziopandini commented 4 months ago

The Cluster API project currently lacks enough contributors to adequately respond to all issues and PRs.

As discussed with SIG security folks back in detroit when we did a retrospective on this security assessment (@aladewberry), given different staffing/size of projects, the only viable way for subprojects to handle vulnerability reporting process is to rely on the K8s process

fabriziopandini commented 4 months ago

/close

k8s-ci-robot commented 4 months ago

@fabriziopandini: Closing this issue.

In response to [this](https://github.com/kubernetes-sigs/cluster-api/issues/5398#issuecomment-2069695439): >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.