Unified Tool for Security Scans in Kubeflow Projects

[andreyvelich]

As part of the last KFP call, we discussed that it would be nice to have unify tool to scan our images for CVEs: https://youtu.be/wvGctNDiF2E?t=1125. Right now, Kubeflow repos use Dependabot for static analysis, it automatically creates PRs to update the dependencies for each language.

However, one of the requirements is to run scanning on releases, given that each Kubeflow project has its own release schedule, we should integrate it as part of GitHub Actions CI.

I am aware of those tools:

• @droctothorpe was talking about: https://github.com/mend
• Argo Workflows uses Snyk: https://github.com/argoproj/argo-workflows/blob/main/.github/workflows/snyk.yml
• Kubeflow Spark Operator uses Trivy: https://github.com/kubeflow/spark-operator/blob/master/.github/workflows/trivy-image-scanning.yaml
• Kubeflow Manifests uses Trivy: https://github.com/kubeflow/manifests/blob/master/.github/workflows/trivy.yaml#L48

Thoughts @kubeflow/kubeflow-steering-committee @kubeflow/kubeflow-outreach-committee @kubeflow/wg-pipeline-leads @kubeflow/wg-data-leads @kubeflow/wg-training-leads @Electronic-Waste @kramaranya @astefanutti @szaher @kubeflow/wg-manifests-leads @kubeflow/wg-notebooks-leads @chensun @droctothorpe @HumairAK @mprahl @zazulam @anishasthana ?

/area security

[anishasthana]

If Snyk is sufficient for Argo Workflows I think it'd be reasonable for us to use as well... but I also don't have strong enough feelings to insist on it.

[juliusvonkohout]

Trivy is checking for vulnerable dependencies in all OCI images so that makes a lot of sense for me.

[andreyvelich]

Did someone try to compare Snyk vs Trivy ?

[mprahl]

One other option to consider is using Syft to generate SBOMs to put in our container images at build time and then using Grype to scan the SBOMs.

[tarilabs]

all else equal I'd lean into Snyk simply because it's a CNCF sponsored for Projects https://contribute.cncf.io/resources/project-services/hosted-tools/#tools:~:text=Snyk%20for%20container%20image%20scanning but from MR we can align as always with any community-wide decision 👍

[kramaranya]

+1 for Trivy, it meets all our requirements without any secret/account management overhead, plus we already have it working in Manifests and Spark Operator