search

openkruise / kruise

Automated management of large-scale applications on Kubernetes (incubating project under CNCF)
https://openkruise.io
Other
4.65k stars 768 forks source link

[feature request] Add fuzz-testing #1713

Open harshitasao opened 2 months ago

harshitasao commented 2 months ago

What would you like to be added: Fuzz testing or Fuzzing is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.

Integrate the project with OSS-Fuzz by following the instructions here.

Why is this needed: To increase the security posture of the project.

Part of #1706

Maintainers help is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.

furykerry commented 2 months ago

openkruise is driven by CRD manifests，and crd will be validated by webhook. I am not sure how semi-malformed data can be used to test openkruise, are their any example in related project, e.g. kubernetes project ?

hantmac commented 2 months ago

@furykerry There are CNCF fuzzzing projects in https://github.com/cncf/cncf-fuzzing and kubernetes also has its fuzzing tests https://github.com/kubernetes/kubernetes/blob/master/pkg/api/testing/fuzzer.go.

I would like to try to use OSS-Fuzz to establish a continuous fuzzing set up for kruise.