search

nginxinc / kubernetes-ingress

NGINX and NGINX Plus Ingress Controllers for Kubernetes
https://docs.nginx.com/nginx-ingress-controller
Apache License 2.0
4.62k stars 1.96k forks source link

Investigate image maintenance for reduced CVEs #4857

Closed brianehlert closed 1 month ago

brianehlert commented 8 months ago

Investigate image maintenance processes around:

The expectations that we are trying to meet are:

The goal is for us to understand the impacts of updating our processes to meet these increased expectations. How many versions back we would actively maintain.

Things to bear in mind: What are the interactions with other capabilities such as readOnlyRootFilesystem and NAP WAF.

### Tasks
- [ ] ~POC - CIS Hardening~
- [ ] ~POC - Make use of leaner images~
- [ ] ~https://github.com/nginxinc/kubernetes-ingress/issues/5395~
- [ ] ~SPIKE - Options for image update notifications~
jjngx commented 8 months ago

References:

CIS Hardening and verification OSS tools

Docker Bench for Security is an open source script that audits containers according to the CIS benchmark’s best practices. It performs tests based on CIS benchmark recommendations, and logs its findings.

For each CIS benchmark recommendation, the tool provides Info (issues found), Warning (container does not meet the recommendation), or Pass (container is compliant). You can run the tool from the Docker host, directly on the host operating system, or clone it with Docker Compose.

OpenSCAP includes multiple open security benchmark guidelines, configuration criteria, and open source tools that can help test for security issues, including the CIS benchmark. It is focused on the NIST-certified Secure Content Automation Protocol (SCAP), which includes many automated security policies.

OpenSCAP goes wider than the CIS recommendations, including many other recommendations, some of which are not specific to a containerized environment. It can be useful for identifying additional security concerns not covered by the CIS guidelines.

Syft A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like Grype.

Grype A vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Works with Syft, the powerful SBOM (software bill of materials) tool for container images and filesystems.

jjngx commented 7 months ago

Updated CIS Benchmarks - January 2024 link

brianehlert commented 4 months ago

Based on conversation and need - I am tempted to close this as an investigation. Thinking that we have decided to: regularly patch the images for the 'current' release.

The question seems to be how we tag the images.

NGINX uses a date tag, and that could be an easy way to discover and pull an updated image when only the image image has been updated but none of the NIC code has been updated.

brianehlert commented 1 month ago

This looks like it should be closed.

brianehlert commented 1 month ago

@danielnginx is this completed? I thought we had a path forward.

brianehlert commented 1 month ago

This remains in 3.6 and is blocking closing the release. Is this completed? still valid?