[Presentation] KubeArmor Project Update

[daemon1024]

Title: KubeArmor Project Update

Speakers:

• Barun Acharya (@daemon1024)

Description: It's been 3 years since KubeArmor has been part of CNCF Sandbox and was last presented in WG-Policy. We want to share progress achieved in terms of development, security and adopters in last 3 years and get feedback for incubation(cncf/toc#1326).

Time: How long will the presentation take? (30 min)

Availability: Any timezone

TO DO

• TAG Representative
• Schedule date
• By opening this issue, I, @daemon1024 acknowledge that the presentation topic and speaker will follow the presentation guidelines
• If this is a presentation for a project moving levels, the TAG Representative should complete the Moving Levels Recommendation

[mrcdb]

Hi @daemon1024 !

These are the next available meeting dates in the different timezones:

• AMER: 9 October 10AM PDT (UTC-7)
• APAC: 2 October 12PM AEST (UTC+10)
• EMEA: 23 October 1PM UK (UTC+1)

Would any of this work for you?

[daemon1024]

Hey @mrcdb

Oct 9, the AMER call works perfect for us.

[brandtkeller]

TAG recommendation to TOC

Project Overview

Ecosystem Adoption

Last 3 years - since Sandbox

30 -> 150+ Contributors
100 -> 1470 stars
30 -> 300 forks

Has seen adoption across Open Source and Enterprise

Past TOC Reviews

Communication channels was originally a finding and have since been resolved.

Security Reviews

TAG Security Assessments

Informed of the Self and Joint Assessment

Security Audit

AccuKnox threat modeling - link

Findings resulted items of best practices being resolved

Best Practices

Metrics

OpenSSF best Practices 7.9
Fuzz Testing

Static Analysis

Codeql and GoSec
Other security measures annotated in the repo

Sub-project Considerations

30 repositories total in the organization

The primary repositories abide by security best practices.

TAG Recommendation to the TOC

The project has seen significant growth and adoption since the original acceptance to Sandbox. Having conducted threat modeling and implemented a number of static analysis and security processes in the development lifecycle provides a healthy project stance for security.

The self assessment is required for projects applying for Incubation in order for the Security TAG to provide a recommendation to the TOC.