Request a Snyk Service Account for Proof of Concept

[dims]

Context :

Snyk has found a few things for us so far:

• Moving to a fork for jwt-go with a CVE fix (transient dependency) kubernetes#100401
• Update github.com/miekg/dns to pick up fix for CVE-2019-19794. kubernetes#97405
• Bump github.com/Azure/go-autorest/autorest/adal to 0.9.5 kubernetes#95692

We had been talking to Snyk for a while now:

• Track CVEs for kubernetes dependencies... community#2992
• https://kubernetes.slack.com/archives/CHGFYJVAN/p1595258034095300
• https://kubernetes.slack.com/archives/CHGFYJVAN/p1594810830090800

Currently @PushkarJ @navidshaikh and others are looking at possibilities of automating (at least a proof of concept) to see what's possible.

Just to be clear, All this is stuff we would do BEFORE a release. We are not talking about scanning containers here, just sanity check of dependencies that we pull in.

What's the ask?

• Request CNCF folks (hi @idvoretskyi !!) to create a Snyk free account and an Org for Kubernetes with those who are doing the proof of concept
• Then we need to email Snyk folks to add the ability to mint new service accounts which can then be used in CI.

If you all approve, i can open up a service desk ticket with CNCF and get this going.

thanks,
Dims

/area code-organization
/sig architecture

[k8s-ci-robot]

@dims: The label(s) area/code-organization cannot be applied, because the repository doesn't have them.

In response to this:

Context :

Snyk has found a few things for us so far:

• Moving to a fork for jwt-go with a CVE fix (transient dependency) kubernetes#100401
• Update github.com/miekg/dns to pick up fix for CVE-2019-19794. kubernetes#97405
• Bump github.com/Azure/go-autorest/autorest/adal to 0.9.5 kubernetes#95692

We had been talking to Snyk for a while now:

• Track CVEs for kubernetes dependencies... community#2992
• https://kubernetes.slack.com/archives/CHGFYJVAN/p1595258034095300
• https://kubernetes.slack.com/archives/CHGFYJVAN/p1594810830090800

Currently @PushkarJ @navidshaikh and others are looking at possibilities of automating (at least a proof of concept) to see what's possible.

Just to be clear, All this is stuff we would do BEFORE a release. We are not talking about scanning containers here, just sanity check of dependencies that we pull in.

What's the ask?

• Request CNCF folks (hi @idvoretskyi !!) to create a Snyk free account and an Org for Kubernetes with those who are doing the proof of concept
• Then we need to email Snyk folks to add the ability to mint new service accounts which can then be used in CI.

If you all approve, i can open up a service desk ticket with CNCF and get this going.

thanks,
Dims

/area code-organization
/sig architecture

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dims]

cc @ericsmalling @elson @anthogez

[ericsmalling]

FYI - I work on Snyk DevRel team and am happy to help in any way (or connect people to those that can help)

[nikhita]

+1 (steering hat on)

[liggitt]

+1

[caniszczyk]

FYI CNCF/LF have a relationship with Snyk (powers some of our security tools) so we can help if needed but I think we should be just OK with their normal free offering, I'll let @idvoretskyi steer as he's setup snyk for other CNCF projects.

[dims]

Thanks @caniszczyk we will reach out to @idvoretskyi next week to get this going.

[idvoretskyi]

/assign

@dims sure, let’s catch up and we’ll sort it out :)

[dims]

slack discussion: https://kubernetes.slack.com/archives/CPNFRNLTS/p1618404479022100?thread_ts=1618404437.021700&cid=CPNFRNLTS
CNCF service desk ticket: https://cncfservicedesk.atlassian.net/servicedesk/customer/portal/1/CNCFSD-756

[PushkarJ]

Related issue for visibility of fixed CVE info in release notes: kubernetes/release#1354 and PR: kubernetes/release#1996 cc @navidshaikh

[puerco]

/cc

[idvoretskyi]

The access is granted - is there anything else on this one @dims?

[dims]

all set! thanks @idvoretskyi

[idvoretskyi]

/close

we may reopen if needed :)

[k8s-ci-robot]

@idvoretskyi: Closing this issue.

In response to this:

/close

we may reopen if needed :)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.