|
1 | 1 | # 2024 Annual Report: SIG Security |
2 | 2 |
|
3 | | -## Current initiatives and Project Health |
| 3 | +## Current Initiatives and Project Health |
4 | 4 |
|
5 | 5 | 1. What work did the SIG do this year that should be highlighted? |
6 | 6 |
|
7 | | -<!-- |
8 | | - Some example items that might be worth highlighting: |
9 | | - - Major KEP advancement |
10 | | - - Important initiatives that aren't tracked via KEPs |
11 | | - - Paying down significant tech debt |
12 | | - - Governance and leadership changes |
13 | | ---> |
| 7 | +SIG Security has been cultivating new generations of contributors and as we continue to grow together, we have brought in new leadership across the SIG and its subprojects. In 2024 Cailyn Edwards joined us as co-chair, Iain Smart has been leading the third-party audit with Rey Lejano, Rory McCune has been leading SIG Security Docs along with Savitha Raghunathan, and Mahé Tardy and Eric Smalling joined us as new shadow leads for SIG Security Tooling! |
| 8 | + |
| 9 | +In 2024, SIG Security’s Third-Party Audit subproject started the process for the latest comprehensive third-party security audit of the Kubernetes project, putting out the RFP, choosing the vendor, and kicking everything off. The new audit is now in progress, and will be completed in 2025! |
| 10 | + |
| 11 | +SIG Security Docs published the [Application Security Checklist](https://kubernetes.io/docs/concepts/security/application-security-checklist/), a dedicated resource to help developers deploy applications securely on Kubernetes. This helps make Kubernetes security more accessible, since most Kubernetes security advice is written for cluster administrators rather than application developers. |
| 12 | + |
| 13 | +SIG Security Tooling has adopted [cve-feed-osv](https://github.com/kubernetes-sigs/cve-feed-osv/), a set of tools to generate OSV-format documentation for CVEs issued by Kubernetes. These tools help end-users get fewer false-positive vulnerability scanner results, by ensuring higher quality detections in their scanning tools. In the future, these tools may become part of the [official CVE feed](https://kubernetes.io/docs/reference/issues-security/official-cve-feed/). |
14 | 14 |
|
15 | 15 | 2. Are there any areas and/or subprojects that your group needs help with (e.g. fewer than 2 active OWNERS)? |
16 | 16 |
|
| 17 | +SIG Security Docs has lots of projects to help contribute to! We pride ourselves on providing an inclusive and welcoming environment for contributors of all experience levels, so this is a great place to plug in for new and experienced contributors alike. If you’re security minded and looking to contribute to Kubernetes, come sit with us! |
17 | 18 |
|
18 | 19 | 3. Did you have community-wide updates in 2024 (e.g. KubeCon talks)? |
19 | 20 |
|
20 | | -<!-- |
21 | | - Examples include links to email, slides, or recordings. |
22 | | ---> |
| 21 | +SIG Security did a maintainer track talk at KubeCon EU 2024: [SIG Security Update:Growing Together](https://www.youtube.com/watch?v=4TYjaI0tBBM) |
23 | 22 |
|
24 | | -4. KEP work in 2024 (v1.30, v1.31, v1.32): |
25 | | -<!-- |
26 | | - TODO: Uncomment the following auto-generated list of KEPs, once reviewed & updated for correction. |
| 23 | +By consensus of the leads, SIG Security did not have any official representation at KubeCon NA 2024 in Salt Lake City due to Utah’s anti-transgender laws. We were very disappointed in the decision to hold the conference in a place that was unsafe for our leadership and the people we love, and we are very much looking forward to seeing everyone in Europe in 2025! |
27 | 24 |
|
28 | | - Note: This list is generated from the KEP metadata in kubernetes/enhancements repository. |
29 | | - If you find any discrepancy in the generated list here, please check the KEP metadata. |
30 | | - Please raise an issue in kubernetes/community, if the KEP metadata is correct but the generated list is incorrect. |
31 | | ---> |
32 | | - |
33 | | -<!-- |
| 25 | +4. KEP work in 2024 (v1.30, v1.31, v1.32): |
34 | 26 |
|
35 | | - --> |
| 27 | +In 2024 SIG Security [removed SecurityContextDeny](https://github.com/kubernetes/enhancements/issues/3785), a feature that was so old it predated the KEP process! This feature had been deprecated for many years, but because it was still in the code it still showed up in compliance frameworks such as the CIS Benchmarks. Now users in regulated industries will have less deviation request paperwork to handle, and the project will be more secure as a whole! |
36 | 28 |
|
37 | 29 | ## [Subprojects](https://git.k8s.io/community/sig-security#subprojects) |
38 | 30 |
|
| 31 | +**Continuing:** |
| 32 | + - security-audit |
| 33 | + - security-docs |
| 34 | + - security-tooling |
| 35 | + - sig-security |
39 | 36 |
|
40 | | -**Continuing:** |
| 37 | +**Sunset:** |
41 | 38 | - security-assessments |
42 | | - - security-audit |
43 | | - - security-docs |
44 | | - - security-tooling |
45 | | - - sig-security |
| 39 | + |
| 40 | +In 2024 we archived the Security Self-Assessments subproject, which was formerly led by Ala Dewberry. |
| 41 | + |
| 42 | +Ala led Self-Assessments with skill, warmth, and curiosity, helping so many contributors learn about the security of their own projects and empower themselves via workshops, documentation, and facilitation of self-assessment processes. |
| 43 | + |
| 44 | +Thanks also go to Pushkar Joglekar, for leading the first self-assessment, starting the subproject, and mentoring Ala into this leadership role! |
| 45 | + |
| 46 | +The documentation and artifacts from the Self-Assessments subproject will remain available under https://github.com/kubernetes/sig-security/ for future reference. |
46 | 47 |
|
47 | 48 | ## [Working groups](https://git.k8s.io/community/sig-security#working-groups) |
48 | 49 |
|
49 | | -**Continuing:** |
| 50 | +**Continuing:** |
50 | 51 | - LTS |
51 | 52 |
|
52 | 53 | ## Operational |
53 | 54 |
|
54 | | -Operational tasks in [sig-governance.md]: |
55 | | -- [ ] [README.md] reviewed for accuracy and updated if needed |
56 | | -- [ ] [CONTRIBUTING.md] reviewed for accuracy and updated if needed |
57 | | -- [ ] Other contributing docs (e.g. in devel dir or contributor guide) reviewed for accuracy and updated if needed |
58 | | -- [ ] Subprojects list and linked OWNERS files in [sigs.yaml] reviewed for accuracy and updated if needed |
59 | | -- [ ] SIG leaders (chairs, tech leads, and subproject leads) in [sigs.yaml] are accurate and active, and updated if needed |
60 | | -- [ ] Meeting notes and recordings for 2024 are linked from [README.md] and updated/uploaded if needed |
61 | | - |
62 | | - |
63 | | -[CONTRIBUTING.md]: https://git.k8s.io/community/sig-security/CONTRIBUTING.md |
64 | | -[sig-governance.md]: https://git.k8s.io/community/committee-steering/governance/sig-governance.md |
65 | | -[README.md]: https://git.k8s.io/community/sig-security/README.md |
66 | | -[sigs.yaml]: https://git.k8s.io/community/sigs.yaml |
67 | | -[devel]: https://git.k8s.io/community/contributors/devel/README.md |
| 55 | +Operational tasks in [sig-governance.md]: |
| 56 | +- [x] [README.md] reviewed for accuracy and updated if needed |
| 57 | +- [x] [CONTRIBUTING.md] reviewed for accuracy and updated if needed |
| 58 | +- [x] Other contributing docs (e.g. in devel dir or contributor guide) reviewed for accuracy and updated if needed |
| 59 | +- [x] Subprojects list and linked OWNERS files in [sigs.yaml] reviewed for accuracy and updated if needed |
| 60 | +- [x] SIG leaders (chairs, tech leads, and subproject leads) in [sigs.yaml] are accurate and active, and updated if needed |
| 61 | +- [x] Meeting notes and recordings for 2024 are linked from [README.md] and updated/uploaded if needed |
| 62 | + |
| 63 | +[CONTRIBUTING.md]: https://git.k8s.io/community/sig-security/CONTRIBUTING.md |
| 64 | +[sig-governance.md]: https://git.k8s.io/community/committee-steering/governance/sig-governance.md |
| 65 | +[README.md]: https://git.k8s.io/community/sig-security/README.md |
| 66 | +[sigs.yaml]: https://git.k8s.io/community/sigs.yaml |
| 67 | +[devel]: https://git.k8s.io/community/contributors/devel/README.md |
0 commit comments