►
From YouTube: SIG Testing: Intro And Updates - Benjamin Elder & Michelle Shepardson & Chao Dai, Antonio Garcia
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
SIG Testing: Intro And Updates - Benjamin Elder & Michelle Shepardson & Chao Dai, Google; Antonio Ojea Garcia, Red Hat
Speakers: Michelle Shepardson, Antonio Ojea Garcia, Chao Dai, Benjamin Elder
SIG Testing is the special interest group for the test tooling and infrastructure of the Kubernetes project. The SIG maintains Prow (Kubernetes's CI), KIND, kubetest, the e2e-framework, and related tools. In this session the SIG Testing leads will provide an introduction to the SIG and an overview of how to contribute. They will share the work done over the past year The session will conclude with Q&A.
A
B
B
C
You
and
hello
I'm
Tabitha
Sable
I'm,
one
of
the
co-chairs
of
Sig
security
I'm,
also
a
member
of
the
kubernetes
security
response
committee
and
staff
engineer
at
datadog,
focusing
on
infrastructure
security,
so
click
for
me,
So
yeah.
Thank
you.
So
much
for
coming
to
hear
a
little
bit
about
Sig
security.
I'm
super
happy
to
share
it.
We
are
a
horizontal
Sig
that
works
with
all
of
the
other
sigs
within
kubernetes
to
continually
improve
the
security
of
this
kubernetes
project,
both
the
software
and
the
user,
experience
for
our
users
and
also
things
within
the
project.
C
So
the
way
that
we
do
this
is
really
specific.
We
focus
on
building
Community,
we
focus
on
building
relationships
within
kubernetes
and
with
folks
out
in
the
rest
of
the
world,
because
kubernetes
is
a
is
a
large
and
complex
project,
but
even
in
something
simpler,
security
is
not
the
sort
of
topic
that
one
person
or
one
entity
or
one
Authority,
can
assure
for
a
project
for
an
organization
for
anything,
and
so
since
any
contributor
can
potentially
make
the
security
of
the
project
Better
or
Worse,
we
are
focused
on
ensuring
that
everyone
has.
C
The
possibility
to
come
together,
learn
share
what
they
know
and
together
improve
the
security
of
the
project.
So
we
do
this
by
making
documentation
process
and
feature
improvements
within
kubernetes,
so
that
means
that
sometimes
some
caps
appear
in
a
related
Sig
and
they
say
to
themselves
this
has
this
has
security
implications?
Let's
also
go
in
and
talk
with
the
six
security
folks
about
it.
C
Sometimes
sick
security,
folks,
I,
don't
know
wake
up
or
or
get
out
of
the
shower,
or
you
know,
whatever
sort
of
thing
gives
you
ideas,
sometimes
sick
security
folks,
say
I,
wonder
about,
and
then,
when
that
happens,
we
we
discuss
it.
Everybody
brings
their
thoughts,
their
experience
and
sometimes
those
things
go
out
to
other
cigs
and
we
say:
Sig
security
has
been
thinking
about
this.
We
wonder
what
you
think
about
it.
Is
this
something
that
you'd
like
to
work
on
together
and
then
then
that
happens,
and
then
we
see
caps.
C
We
see
improvements
and
it's
all
based
on
talking
to
each
other,
sharing
our
learnings
and
using
consent
with
each
other.
So
we
also
provide
some
security
related
services
within
kubernetes.
We'll
hear
a
little
bit
more
about
that
when
we
get
to
the
tooling
subproject
and
we
also
serve
as
the
public
forum
for
the
security
response
committee
security
response
committee
meetings
are
private
due
to
the
nature
of
the
work,
but
as
the
SRC.
C
D
B
Thank
you
Debbie,
so
kubernetes
website
is
awesome
right.
We
all
have
used
it
and
we
still
use
it
close
to
the
seek
documentation.
Folks,
I
know
I,
see
some
of
the
faces
here
and
all
the
contributors
who
have
contributed
to
make
it
awesome.
What
do
we
do
here?
So
we
want
to
just
enhance
the
documentation
by
creating
a
security
awareness,
and
we
do
that
by
adding
tutorials
security
tutorials
and
then,
like
more
security,
related
examples
and
keeping
the
things
up
to
date.
Right
we
don't
want
to
have
an
outdated
example.
B
Then
you
just
copy
paste
it
into
a
cluster,
and
then
there
you
go.
You
just
created
a
nightmare
for
yourself,
some
other
some
on
some
other
day,
not
on
the
same
day.
So
that
is
the
major
goal
of
this
project,
and
some
of
the
recent
highlights
of
this
project
includes
the
Most
Wanted
feature
kubernetes
security
list,
so
we
have
recently
published
the
kubernetes
security
list
and
all
these
are
hyperlinks.
So
once
the
slide
is
available,
you
should
be
able
to
click
on
it.
We
recently
published
it.
B
It's
it's
a
nice
little
thing,
it's
like
a
trivia
thing,
so
one
of
the
contributors
published
a
post
and
my
favorite
thing
is
the
historical
chart
like.
If
you
go
to
the
blog
post
link
there,
you
can
see
like
the
timeline,
and
that
is
my
favorite
part
of
the
entire
blog.
In
addition
to
all
the
Tas,
of
course
thank
you.
B
B
Kalin,
so
we
are
gonna
this
time
we
are
going
to
do
a
little
different,
so
we're
gonna
divide
it
by
into
multiple
little
tasks
so
that
new
contributors
existing
contributors,
whoever
wants
to
like
contribute,
can
come
in
and
take
a
piece
and
support
that
into
the
project.
So
that
is
the
major
idea
of
that
one
and
then
we're
gonna
add
more
tutorials,
mainly
our
back.
B
That
is
like
one
of
the
goals,
personal
goals
that
I
have
hopefully
I'll
get
to
that
or
like
I'll.
Let
any
of
the
awesome
contributors
get
to
that,
and
another
thing
that
we
have
been
talking
about
is
the
confidential
kubernetes.
So
that
is
quite
the
bus
and
we
are,
there
are
like
awesome
contributors
again
working
on
a
blog
post,
so
look
forward
to
that
sometime
in
the
quarter
next
quarter
sometime
next
year,
hopefully
so
we'll
we'll
get
that
out.
So
those
are
the
interesting
things
that
we
are
working
on.
B
C
Yeah,
thank
you
so
much.
We
have
third
party
audit
sub
project,
which
is
organized
by
my
fabulous
colleague
Ray,
who
you
may
also
know
from
the
release
team
and
Sig
Docs
and
the
third
party
audits.
A
project
focuses
like
you
would
guess,
from
the
name
on
facilitating
periodic
professional
external
audits
of
the
kubernetes
code
base,
and
this
provides
us
a
couple
of
different
values.
C
It
helps
to
serve
as
a
check
for
the
work
that
all
of
the
contributors
and
maintainers
are
doing
all
of
the
time
to
represent
security
needs
within
the
work
that
they're
doing
every
day,
and
it
helps
to
discover
new
potential
problems
so
that
we
can
address
them
earlier
before.
Hopefully,
they
are
discovered
in
the
wild
and
used
for
some
kind
of
harmful
purpose.
C
Organizing
a
professional
code,
audit
of
a
large
project
like
kubernetes,
requires
lots
of
logistics
requires
a
lot
of
communication
with
the
selected
vendor
in
order
to
help
to
guide
them
through
an
effective
way
to
take
a
journey
through
the
huge
code
base
and
the
folks
from
the
audit
subproject
have
done
a
great
job
of
sharing
their
expertise
with
our
vendor.
In
order
to
get
them
into
the
right
places
and
find
things
that
might
go
bump
in
the
night,
they've
recently
published
a
blog
post
about
a
retrospective
of
the
previous
audit
that
completed
in
2019.
C
The
current
audit
that
started
in
late
2021
has
wrapped
up
and
the
results
from
it
are
being
reviewed
within
the
security
response
committee.
So
we
will
see
the
full
report
from
the
Auditors
published
as
soon
as
the
private
response
is
completed
and
they're,
making
sure
that
what
they
learn
from
going
through
this
process
also
gets
shared
back
with
the
folks
in
the
security,
self-assessment
sub
project
and
the
folks
in
cncf
tag
Security
in
order
to
get
all
of
the
learnings
shared
around
everywhere,
so
that
we
can
all
continue
to
get
better
from
each
other's
experience.
C
B
B
So
what
do
we
do
here?
We
build
and
enhance
security
through
code,
and
we
do
that
by
collaborating
with
various
projects
and
other
various
six
in
the
kubernetes
and
the
project
is
the
product
meets
every
other
week
on
Wednesdays
and
they
alternate
between
a
working
session
and
then
a
learning
session.
B
The
learning
sessions
awesome
super
cool,
and
if
you
are
someone
in
the
industry
or
like
or
someone
like
us
learning
and
building
kubernetes
security
tools,
you
can
sign
up
in
the
list
and
then
come
show
off
whatever
that
you
have
learned
or
whatever
the
tools
that
they
are
built
or
like.
If
you
even
find
something
like
super
cool,
that's
related
to
kubernetes
security,
you
can
just
bring
it
here,
and
that
is
that
is.
That
is
really
awesome,
and
that
is
one
of
the
highlights
of
the
tooling
project
as
well.
B
And
so,
if
you
are
like
me
right
so
how
many
of
you
used
to
subscribe
to
the
security
announced
mailing
list
and
whenever
there
was
a
CV
announced,
you
read
through
it
and
you
are
like.
Oh,
my
God
I
need
to
update
this
I
need
to
like
patch.
My
servers
I
need
to
do
this
and
then,
like
after
two
days,
I
have
thousand
emails
shift,
delete
or
like
control,
delete
right,
it's
all
gone
and
then,
like
that
you,
you
cannot
find
the
information
in
a
mailbox.
B
Then
you
have
to
go
to
the
Google
Groups
and
like
search
through
and
whatnot.
So
the
tooling
people,
automated
everything
and
it
is
available
in
a
kubernetes
website-
that's
linked
and
we
got
amazing
feedback
from
the
community
and
rest
of
the
announcement
is
in
kept
three
two
or
three
I
hope.
I
got
that
right,
yeah
three
to
O
three
so
like.
If
you're
interested
you
can
go
and
check
that
out.
B
So
the
kubernetes
CI,
which
builds
the
images
container
images
and
also
the
code
itself,
so
there
is
this
vulnerability
scanner
that
has
been
attached
to
everything
now,
so
you
can
get
the
reports
and
what
else
yeah
and
then,
like
we
I,
as
I,
saw
as
I
told,
although,
as
the
goal
suggested,
that
we
work
with
every
others
approach,
every
project
of
security
and
also
various
things,
that's
all
about
tooling
and
I
hope
I
did
Justice
to
the
two
links
of
project.
Thank
you.
Next,
on
to
self-assessment
from
Allah.
A
Mind
if
I
scooch
over
here,
yeah,
so
hello,
folks
so
and
Now
for
Something
Completely
Different
for
those
Monty
Python
fans
out
there
all
right
so
self-assessments.
What
are
we
going
to
talk
about
so
first
we're
going
to
do
a
brief
overview
of
some
history
in
terms
of
the
Cappy
self-assessment
that
was
just
completed
and
kind
of
how
self-assessments
came
to
be
in
kubernetes.
A
Then
we're
going
to
go
through
some
tactical
items
like
what
is
the
goal
of
a
self
self
assessment,
and
how
do
you
do
it
and
how
does
it
also
at
a
more
strategic
level?
How
does
it
Empower
through
autonomy
and
then,
of
course,
I
am
a
product
manager?
So
we're
going
to
talk
about
some
road
map
all
right,
so
a
little
bit
of
History
here
so
in-sig
security.
A
A
It
was
overall
a
positive
experience
and
I
think
it
was
the
first
six
security
meeting
that
I
came
on
that
we
were
talking
about
hey.
You
know
this
kind
of
needs
to
become
a
sub-project.
Now
this
was
successful.
This
is
some.
This
is
a
tool
and
a
framework
that
we
want
to
reuse
in
the
kubernetes
community
and
I,
had
the
amazing,
pleasure
and
honor
of
merging
the
Cappy,
self-assessment,
PR
and
yeah.
A
So
thanks
again
to
pushker,
for
you
know,
just
getting
it
started
and
organizing
it
and
creating
an
opportunity
also
for
someone
new
in
the
community
to
get
involved
right
so
with
some
history
out
of
the
way.
Let's
talk
about
some
goals
so
for
an
individual
self-assessment,
there
are
two
basic
goals.
So
it's
to
answer
two
questions.
So
it's
basically,
what
is
the
security
posture
of
the
workflow
in
the
project
that
we've
modeled
and
then
how
can
we
improve
it?
A
My
thinking
in
terms
of
a
really
good,
North,
Star
and
totally
welcome
for
feedback
on
this
from
the
community
would
be
to
fill
our
repo
with
self-assessments
for
all
the
projects
and
sub-projects
in
kubernetes
I
think
that
that
would
be
so
so
cool.
But
again,
let's,
let's
work
on
and
iterate
on
that
on
that
goal
and
that
Vision
together
all
right
so
part
one.
How
do
you
do
a
self-assessment,
so,
just
at
a
high
level,
a
self-assessment
is
the
process
of
just
mapping
out
a
targeted
workflow
in
in
use
by
the
community.
A
That's
step
one
then
building
a
threat
model
for
that
workflow
sort
of
like
given
the
scenarios.
What
could
go
wrong?
What
are
the
attack
factors
that
could
be
exploited
and
then,
of
course
evaluating
the
security
posture
of
the
workflow
based
on
that
threat
model
of
the
current
day?
So
it's
like
what
are
the
security
controls
that
we
have
in
place
today,
and
would
they
be
effective
against
the
scenarios
that
we
have
decided
to
model
out?
A
So
that's
really
at
a
high
level,
but
let's
go
a
step
deeper
in
terms
of
what
this
is
here.
So
the
first
thing,
the
first
sort
of
event
that
happens,
that
tells
us
hey,
we
need
to
do
a
self-assessment
is
that
we
receive
a
request.
So
we
do
have
an
intake
system
in
GitHub
setup
so
that
you
can
go
ahead
and
request
sick
security
to
to
do
a
self-assessment.
So
that's
the
first
thing.
The
next
step
is
to
find
your
people.
A
So,
given
the
project
or
sub-project
that
wants
and
has
requested
a
self-assessment,
the
exercise
becomes
all
right.
We
need
folks
who
are
experts
in
the
or
who
have
deep
knowledge
of
the
project
or
sub-project
itself,
how
it's
architected,
and
then
we
need
folks
who
have
skills
along
the
lines
of
being
able
to
build
threat
models
for
stuff.
A
So
currently
right
now,
the
next
self-assessment
in
the
queue
is
for
the
vsphere
CSI
driver
and
I
need
to
find
Shang
at
some
point
to
you
know,
start
coordinating
that
process,
but
it's
really
building
your
team
sort
of
what
are
the
skill
sets
that
you
need
to
make
this
a
successful
use
of
everyone's
time.
So
once
you've
got
your
people
in
place,
the
next
step
is
to
just
map
out
the
architecture
of
whatever
it
is
you're
building.
A
So
a
lot
of
projects
have
this
already
mapped
out,
so
this
is
usually
a
fairly
easy
step,
but
it's
also
a
good
exercise
that,
oh,
maybe,
if
it's
a
little
weak
in
some
areas,
you
know
let's
go
ahead
and
Tackle
this.
You
know
we
can't
secure
what
we
can't
see.
So,
let's
do
it
so,
with
that
architecture
mapped
out,
then
you
can
start
to
look
at
okay.
A
What
are
the
sort
of
highest
priority
areas
that
we
would
want
to
do
a
threat
model,
for
you
know-
and
this
is
generally
I-
actually
asked
this
for
the
vsphere
Cs
Drive
driver.
You
know
what's
the
priority:
what's
the
used
the
most
in
the
community,
because
that's
that
you
know
represents
the
the
biggest
attack
surface
and
as
it
turns
out,
it's
a
vsphere
CSI
driver
for
vanilla
kubernetes.
So
we're
going
to
do
that.
First,
then,
it's
just
a
question
of
mapping
out
that
workflow
sort
of
how
does
data
move
through
that
system?
A
And
you
know
what
does
that
look
like
then,
based
on
that
building
out
your
threat
model
sort
of
how
could
someone
who's
a
bit
naughty,
exploit
this
and-
and
you
know,
potentially
make
someone's
day
not
awesome
and
then
to
just
evaluate
the
weaknesses
based
on
sort
of
the
worst
things
that
you
can
think
of
that
could
happen
and
then,
of
course,
to
capture
and
prioritize
those
action
items
all
right.
So
next
question:
how
does
this
Empower
through
autonomy?
A
So
it's
really
about
just
taking
every
opportunity
that
we
can
to
Federate
security
knowledge,
which
is
you
know,
done
by
doing
things
like
you
know,
socializing
this
framework
and
socializing
sort
of
the
more
human
concepts
of
building
your
team.
Getting
the
right
skill
sets
together
for
success
all
right.
So
how
are
we
going
to
keep
empowering
through
autonomy
so
by
virtue
of
arming
the
community
with
a
simple
set
of
tools
to
you
know
raise
raise
the
tide
so
to
speak
in
terms
of
our
security
posture?
A
A
Of
course,
when
you
socialize
things
and
you
ask
for
feedback,
you
get
feedback
which
means
that
you
can
improve
it
and
refine
it.
What
a
concept
and
then,
of
course,
in
a
more
tactical
sense,
like
I've,
been
saying
the
vsphere
CSI
driver,
self-assessment,
is
next
and
my
open
invitation
to
everyone
is
to
come.
Join
us.
A
Actually
Savita
introduced
me
to
someone
who
is
in
this
audience
right
now,
who's
interested
in
getting
started
and
we're
going
to
go
on
this
Learning
Journey
together,
and
it's
it's
going
to
be
great,
so
I'm
really
excited
and
also
actually
this
is
I
should
almost
cross
this
one
off
complete
the
Retro
for
the
Cappy
self-assessment.
We
actually,
some
of
us
got
together
in
the
speaker,
lounge
and
we
chatted.
We
shared
a
bunch
of
things.
A
And
if
you
sign
up
for
our
mailing
list,
you
get
added
to
the
bi-weekly
meetings,
which
are
9,
A.M,
Pacific,
12
p.m,
Eastern
every
other,
Thursday,
so
yeah
come
join.
The
fun
come,
have
a
hunk
with
us,
of
course,
and
yeah.
Thank
you
so
much.
It's
been
a
real
pleasure
to
to
do
this
with
with
you
all
and
yeah
I
believe
we
have
some
time
for
questions.
D
Thank
you.
This
is
awesome,
so
thank
you
very
much
for
this
I
where
do
I
sign
up,
but
at
add
Ingress
nginx
to
the
list,
because
we
need
this
besides
running
through
the
self-assessment
and
making
sure
you're
doing
that
quarterly.
What
are
some
suggestions
that
you
would
have
to
help
increase
the
security
of
a
project
because
I
know
when
I
get
a
security
release
from
you?
Tabby,
it's
not
fun,
but
what
are
some
things
that
we
can
do
to
help
secure
the
projects?
C
Yeah
I'll
start
with
the
specific
part.
First,
you
literally
can
sign
up.
If
you
go
to
the
kubernetes,
slash
Sig
security,
repo
on
GitHub,
you
can
go
to
file
an
issue
and
there's
an
issue
template
for
registering
your
sub
Project's
interest
in
having
help
from
sick
security
to
go
through
the
process
of
doing
a
self-assessment
more
generally,
at
that
level
of
generality.
C
You
know
that
can
go
into
things
like
intentional
misuse
of
features
that
can
go
into
finding.
You
know
Finding
bugs
like
finding
parsing
errors
or
type
confusion
errors
in
network
protocols.
It
can
that
asking
yourself
that
question
what
harm
could
I
do
with
this
can
lead
to
a
lot
of
can
lead
to
a
lot
of
places
and
the
the
other
thing
that
I
would
say
is
to
continue
to
stay
curious.
C
But
that
means
that
I
don't
get
to
spend
all
of
my
time
with
anybody's
particular
piece
of
software
with
you
know
the
you
know,
with
with
the
Ingress
engine
hex
controller,
with
the
vsphere
CSI
driver,
the
folks
who
were
doing
the
development
they
get
to
spend
all
of
their
time
with
that.
And
so
then
we
can
meet
in
the
middle
there,
where
I
can
learn
something
about
like
what
you're
doing
or
you
know
what
whoever
I'm
trying
to
work
with
is
doing,
and
they
can
learn
something
about
more
General
Security
properties.
A
Yeah
I
just
wanted
to
highlight,
like
the
part
about
getting
social
and
and
like
sharing,
sharing
your
curiosity
honestly
and
sharing
hey
I'm
thinking
about
security.
I
would
love
to
get
other
folks
thoughts.
You
know,
especially
with
you
know,
folks,
who
are
your
peers
folks,
who
are
more
junior
to
you
too.
A
It's
really
about
bringing
that
security
like
making
it
as
incremental
as
we
possibly
can
to
be
secure
a
little
bit
all
the
time
so
to
speak.
That's
where
you're
gonna
see
the
biggest
gains,
because
changes
always
happen
at
the
margins
in
in
some
way,
shape
or
form
and
but
yeah
I
think
getting
social
staying
curious,
but
also
like
persisting
and
circulating.
Your
curiosity
is
so
powerful
foreign.
B
That
is
also
a
great
place
to
like
get
it
done
from
the
start
in
the
right
way,
because
you
know
it's
easier
to
find
it
find
I
mean
it's
not
possible
to
find
everything
I'm,
not
saying
that
we
can
do
everything,
but
it's
sometimes
it's
easier,
because
the
third
party
will
have
the
ice
for
something
that
you
missed,
and
it
would
always
be
nice
to
get
like
a
another
opinion.
So
that's!
That's
all
I
wanted.
E
E
I
all
the
time
coming
up
with
security
issues.
It
would
be
very
nice,
you
know
we
could.
We
could
probably
start
doing
some
mini
Summits
around
like
we're
right
now
we're
just
doing
the
username
space
isolation
sort
of
in
our
own
little.
You
know
hovel
it'd
be
nice.
If
we
could
expand
that
out
a
little.
F
C
C
Yeah
those
those
kinds
of
questions
given
given
the
roles
that
I
have
both
in
the
private
space
in
security
response
committee
and
the
public
space
insect
security.
Those
kinds
of
questions
are
always
really
in
the
front
of
my
mind
and
the
way
that
we
deal
with
that
is
by
trying
to
work
as
openly
as
we
can,
while
making
sure
that
we
aren't
sharing
things
until
we
know
what
they
mean,
because
sometimes
yeah
like
you're,
like
you're
saying
sometimes
as
you're
as
you're
working
through
threat,
modeling
a
system
or
a
process.
C
You
could
find
something
that
seems
like
a
nice
Improvement
and
let's
file
an
issue
about
that
someday.
But
you
also
might
find
things
that
that
keep
you
up
at
night
and
then,
in
those
cases,
the
folks
who
are
working
on
that
know
that
they
can
contact
the
SRC
and
go
through
the
existing
private
disclosure
process.
For
that,
like
short
circuit
that
you
know,
it
doesn't
have
to
wait
until
the
end
of
the
self-assessment.