[Blueprint] DOKS Supply Chain Security

[v-ctiutiu]

Overview

Because Kubernetes is such popular nowadays, security plays a vital role. The DOKS Supply Chain Security blueprint main idea is to provide a starting point for developers to set up a CI/CD pipeline with integrated vulnerability scanning support. The main topic and ideas discussed is around supply chain security in the Kubernetes ecosystem.

In terms of tooling, we focus around Kubescape and Snyk. Then, we use two separate guides describing the two. The accompanying examples show the user how to create a standard CI/CD workflow using GitHub actions.

Main topics:

• Short introduction about each tool and features.
• Operation examples.
• GitHub workflow implementation of a typical CI/CD pipeline for both tools (Snyk, Kubescape).
• Export scan results to dashboards for later investigation (cloud portal, as well as GitHub Security).
• Scan results investigation and how to fix reported issues.
• Continuous monitoring for newly disclosed vulnerabilities.
• Basic Slack notification support.
• IDE support.

Additional topics to cover:

• Scan container images in the CI/CD pipeline (or GitHub workflow). Only Snyk supports this feature for now.
• Image signing.
• Admission controllers to allow or deny containers to run based on trust (works in conjunction with image signing).

Other enhancements and nice to haves:

• Slack notifications sent from the GitHub workflow should include the desired and current risk score information for Kubescape (or security level for Snyk).
• If possible, Slack notifications should present a cloud portal link which redirects to the application being scanned.
• Export scan results using GitHub SARIF format. Main benefit is that scan results can be viewed in the Security tab of the GitHub repo.
• Run pipeline build steps only if source code changes - e.g. build and push app docker image only if the Dockerfile has changed and the image needs a rebuild.