[Feature] Improvement of OpenSSF Scorecard Score

[harshitasao]

Problem Statement

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

Solution Description

As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 8.0

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/kyverno/kyverno

Here's a few checks we can work on to improve the project's security posture:

• Token-Permissions: Score = 0

  • The issue here is that this workflow doesn’t have a top-level read-only permissions block like present in the other workflows. Scorecard is quite severe in this check: a single workflow without top-level permissions gets a 0/10 for the check.

• Branch-Protection: Score = 5

  • In my opinion, adding the following checks would be useful:
    1. Require at least 2 reviewers for approval before merging.
    2. Require review from code owners.

  • Or using GH rulesets as these are public and Scorecard will check for these as well.

  • NOTE: This can only be done by the maintainers.

• Signed-Releases: Score = 8

  • SLSA provenance is already added: workflow file updated for slsa provenance generation #4268

• Pinned-Dependencies: Score = 9

  • Github action is not pinned by hash, which results in a low score.
  • PR: fix: fixed the pinned dependencies issue #10910

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

Alternatives

N/A

Additional Context

reference: #2617

Slack discussion

None

Research

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.

[welcome]

Thanks for opening your first issue here! Be sure to follow the issue template!

[realshuting]

Hi @harshitasao - thanks for taking the time to review and help improve Kyverno!

I can help with branch-protection - currently we require at least one reviewer for approval given the limited availability across all reviewers. I can require review from code owners, would this be enough?

[dosubot]

Hi, @harshitasao. I'm Dosu, and I'm helping the kyverno team manage their backlog. I'm marking this issue as stale.

Issue Summary:

• Collaboration with CNCF and Google Open Source Security Team to improve OpenSSF Scorecard score.
• Current score is 8.0, with focus on Token-Permissions, Branch-Protection, and Signed-Releases.
• Feedback requested on prioritizing these areas for improvement.
• @realshuting suggested requiring reviews from code owners for branch protection.

Next Steps:

• Please confirm if this issue is still relevant to the latest version of the kyverno repository. If so, you can keep the discussion open by commenting on the issue.
• If there is no further activity, the issue will be automatically closed in 60 days.

Thank you for your understanding and contribution!