REQUEST: Migrate security-profiles-merger

[saschagrunert]

New repo, staging repo, or migrate existing

migrate existing (saschagrunert/security-profiles-merger)

Is it a staging repo?

no

Requested name for new repository

security-profiles-merger

Which Organization should it reside

kubernetes-sigs

Who should have admin access?

saschagrunert

Who should have write access?

saschagrunert

Who should be listed as approvers in OWNERS?

saschagrunert

Who should be listed in SECURITY_CONTACTS?

saschagrunert

What should the repo description be?

Security profile merge library for Kubernetes CRI runtimes

What SIG and subproject does this fall under?

New subproject for SIG Node

Please provide references to appropriate approval for this new repo

Approved by SIG Node leadership. cc @haircommander @SergeyKanzhelev for confirmation.

Additional context for request

This library provides merging of seccomp, AppArmor, and SELinux security profiles for Kubernetes CRI runtimes. It was extracted from the Security Profiles Operator and is intended to be consumed by CRI-O, containerd, and SPO. Related KEP: kubernetes/enhancements#6062

[SergeyKanzhelev]

/sig node
/sig security
/sig auth

I believe this library is very useful and is mostly re-homing of a library from Security Profiles Operator. So I support the request.

I can make the case that OCI may be a better home for it, but we can start with kubernetes. @samuelkarp for the opinion.

[samuelkarp]

If you would like to have this as an OCI Project, the process is described in section 2(c) of the charter. While OCI is primarily a standards body concerned with hosting specifications, we do have a few smaller projects that also represent cross-cutting concerns in the ecosystem: go-digest, selinux, and cgroups. You can find previous proposals here.

intended to be consumed by [...] containerd

Wearing another hat here: cc @mikebrow @fuweid

[SergeyKanzhelev]

If you would like to have this as an OCI Project,

@samuelkarp does it sound like something OCI may want to standardize around - how to merge security profiles? I just feel like it is more fundamental standard than kubernetes is typically seen.

[samuelkarp]

how to merge security profiles?

It seems like that would probably be in-scope for the runtime-spec. A few comments:

• OCI specifications are prose, not code. We do host some reference implementations (like runc, and the libraries I linked earlier) above when relevant or there are cross-cutting concerns for it.
• OCI is generally a "lagging" standards body and doesn't tend to drive new direction but rather codify consensus and coordinate when there is a need for it. Because this library is intended to be used by multiple runtimes (creating consistent behavior between them) and because it's already used as part of SPO I think it fits.

I'd personally like to see:

• standardized description of the merging behavior in the runtime-spec (working with the existing runtime-spec maintainers on that)
• reference library to implement it, hosted in OCI

The runtime-spec change does not need any governance action. @saschagrunert, I'd encourage you to open up a discussion (issue, PR, etc) with the runtime-spec maintainers on it. The reference library would need a TOB vote, following the process outlined in our charter.

[saschagrunert]

Opened a runtime-spec discussion as suggested by @samuelkarp: opencontainers/runtime-spec#1317