Issue-Label Bot is automatically applying the label improvement/enhancement to this issue, with a confidence of 0.88. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

/area manifests
/priority p1

Is this a duplicate of kubeflow/testing#421

Vulnerability scanning is turned on in our GCR repositories.

I think the next step would be to generate a report with a list of all the vulnerabilities for different images.

I imagine the list of vulnerabilities can be fetched via GCP API from the GCR repository (tutorial).

We probably don't want to look at all images in the registry but instead look through the applications based on kubeflow/manifests; identify the images for different applications and generate a list of vulnerabilities for those docker images.

To start I would suggest focusing on the applications that are in scope for 1.0.

List of applications in scope for 1.0.

It would be great to look at the associated images and open up issues for any ones that have vulnerabilities that need to be fixed.

@elviraux is this something you could help with?

@jlewi 👍🏻

It looks like GCR will automatically show a list of vulnerabilities a long with the severity and whether there are fixes available. This is available just by going to the publicly accessible link.

http://gcr.io/kubeflow-images-public/tensorflow-1.13.1-notebook-gpu

Here's a screenshot

This means for any images we build users can get a report just by going to the GCR link for the image.

This wouldn't apply to images that we pull from other repositories like DockerHub/Quay (e.g. for Argo etc...).

For 1.0 this seems reasonable to me because we are covering only the applications specifically built and maintained by the Kubeflow community.

@jbottum @elviraux Does this seem sufficient to you?

Do we need some privileges to see the vulnerabilities?
I clicked the link and selected the first image but only get the following. No link to vulnerabilities.

@nrchakradhar Looks like you are right; the vulnerabilities aren't publicly visible. So we'll probably need to write some script to fetch them via API and publish them as a markdown doc.

This page has scripts: https://cloud.google.com/container-registry/docs/get-image-vulnerabilities

Started work on a CLI tool to fetch them via API:
https://github.com/CiscoAI/kubeflow-scanner
I'll update progress and if enough people need this we can include it in CI

@swiftdiaries any update?

I'm trying to setup a static site that would show vulnerabilities with the images. I hope to get it done by the end of the week.

@swiftdiaries did you consider just checking in HTML or other output into GitHub?

We do have one here from the tool:
https://github.com/CiscoAI/kubeflow-scanner/blob/master/vuln_report_kubeflow.yaml
There's a wider compilation here:
https://github.com/kubeflow/kubeflow/files/4069971/Kubeflow_images_cves_list.xlsx

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

/lifecycle frozen