Kubernetes-Security-Slam-2023 about kube-state-metrics HOT 10 OPEN

I think the following tasks are already done:

• Check for Binary Artifacts (task 8) (no binaries found in the repo)
• Review the code review (task 9) (all changesets reviewed)
• Dangerous Workflow (task 10) (no dangerous workflow patterns detected)
• Dependency update tool (task 13) (update tool detected, dependabot)

I think the following tasks are still missing something:

• Token Permissions (task 16)

What do you think about publishing the OpenVEX data with the remaining release artifacts?

@SD-13 do you mind if I assign Ensure SBOMs are generated by Kubernetes BOM (task 3) to me?

from kube-state-metrics.

@ricardoapl Please feel free to assign it to you!

from kube-state-metrics.

/triage accepted

from kube-state-metrics.

I'd like to tackle Task 7!

from kube-state-metrics.

Please take a look at the CLOMonitor .yaml PR here:
cncf/clomonitor#1380

Thank you!

from kube-state-metrics.

Hey @mrueg @dgrisonnet @rexagod I want to know whether kube-state-metrics is generating SBOM as part of the release pipeline. Where to look for the release pipeline?

from kube-state-metrics.

I looked into adding the OpenSSF Best Practices badge to the README, but I think a maintainer would need to first request the badge at https://www.bestpractices.dev/

from kube-state-metrics.

Hey @mrueg @dgrisonnet @rexagod I want to know whether kube-state-metrics is generating SBOM as part of the release pipeline. Where to look for the release pipeline?

We're currently not generating it. The release process is documented here: https://github.com/kubernetes/kube-state-metrics/blob/main/RELEASE.md If this is something that can be attached to a github release, it should be triggered by a release creating and execute a github action ideally that attaches the sbom

from kube-state-metrics.

I think https://github.com/advanced-security/gh-sbom (SBOM generation) coupled with https://github.com/anchore/sbom-action (SBOM pushes) should help accomplish the SBOM workflow.

from kube-state-metrics.

FYI Appended some open questions to the issue description.

from kube-state-metrics.