How does Compliant Kubernetes do vulnerability management of itself?

[cristiklein]

Is your feature request related to a problem? Please describe.

Many data protection and critical infrastructures regulations ask for vulnerability management to be taken seriously. We are doing a lot when it comes to vulnerability management, however, this is hidden in internal docs. Let's make them public to gain exposure.

Describe the solution you'd like

Something along the lines of:

Elastisys makes commercially reasonable efforts to ensure that Compliant Kubernetes and Additional Services are free from security vulnerabilities which are either publicly known or known to Elastisys, inter alia:

• Prepare:
  • control what software components are added to software used by Elastisys (link to ADR page);
  • ensure software components are provisioned from vendors which have demonstrated good vulnerability management;
  • ensure the Software Bill of Materials (SBOM) is up-to-date;
  • subscribe to security announcements issued by vendors of software components used by Elastisys (link to security-lists);
  • setup Elastisys vulnerability disclosure channels;
  • ensure via its CNCF membership that open-source projects are sufficiently funded for good vulnerability management;
• Detect:
  • regularly review the output of container scanning tools, such as Trivy; however, they are super-noisy, so we don't aim for "zero vulnerability" to avoid malicious compliance;
  • monitor security announcements issued by vendors of software components used by Elastisys;
  • monitor Elastisys vulnerability disclosure channels and timely fix reported vulnerabilities;
• Respond:
  • we discuss security announcements during our daily stand-up;
  • immediately release security patches for Elastisys software;
  • immediately apply security patches for Elastisys software;
• Recover:
  • identify opportunities to reduce the likelihood or impact of future vulnerabilities.

Additional context

• Vulnerability management needs a separate page #604 complements the present issue. Vulnerability management needs a separate page #604 asks for a description on how Compliant Kubernetes support vulnerability management of the application running on top of Compliant Kubernetes. In contrast, the present issue asks for a description on how Compliant Kubernetes handles vulnerabilities within itself.