Checklist for writing PolicyReport KEP

[anusha94]

The Policy WG presented to SIG-Auth on 7th Dec, 2022 and we have their approval and support to submit a KEP to promote the Policy Report CRD to an official Kubernetes API! 🎉

We want to cleanup on the APIs and make any other changes that are needed before we write and submit the KEP. The below checklist (not final) is to track all such items. Feel free to update this list or comment if there are any concerns.

Tasks

• fix Inconsistent field names #96
• communicate to all stakeholders (see below) about the KEP proposal and get any feedback on the PolicyReport API
• any changes to APIs will be now done for v1beta1
• follow k8s API best practices (K8s API Conventions)
• raise PRs in repositories consuming PolicyReport CRD with any changes
• revisit project structure for apis
• identify KEP prerequisites from this doc

Stakeholders

• Policy Reporter
• Kyverno
• Falco sidekick
• trivy-adapter
• Open Cluster Management
• RedHat ACM
• KubeArmor
• kube-bench adapter
• jsPolicy
• trivy-operator-polr-adapter (https://github.com/fjogeleit/trivy-operator-polr-adapter)
• vulnerability-operator (https://github.com/ckotzbauer/vulnerability-operator)
• tracee-polr-adapter (https://github.com/fjogeleit/tracee-polr-adapter)

[gparvin]

Additional stakeholder:
Open Cluster Management CNCF sandbox project https://open-cluster-management.io/ and Red Hat ACM product https://www.redhat.com/en/resources/advanced-cluster-management-kubernetes-datasheet

[sunstonesecure-robert]

can we change the issue title to mention PolicyReport so in Slack links people see what it refers to? thanks!

[fjogeleit]

Current state of api/client forks

• Policy Reporter uses its own fork/copy of the PolicyReport Go APIs and Clients
• jsPolicy uses its own fork/copy of the PolicyReport Go APIs and Clients
• trivy-operator-polr-adapter uses its own fork/copy of the PolicyReport Go APIs and Clients
• tracee-polr-adapter uses the Kyverno APIs and Client as dependency
• Falcosidekick uses the API and Client from kube-bench-adapter (outdated)
• kube-bench adapter uses the API and Client from kubernetes-sigs/wg-policy-prototypes
• KubeArmor adapter uses the API and Client from kubernetes-sigs/wg-policy-prototypes
• Trivy Adapter adapter uses the API and Client from kubernetes-sigs/wg-policy-prototypes
• vulnerability-operator uses the API and Client from kubernetes-sigs/wg-policy-prototypes

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Ais8Ooz8]

@anusha94 @fjogeleit

raise PRs in repositories consuming PolicyReport CRD with any changes

Maybe we should start by creating issues in these repositories and thereby starting discussions?

[Ais8Ooz8]

/reopen
/remove-lifecycle rotten

[k8s-ci-robot]

@Ais8Ooz8: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen
/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.