You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cloudstack.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/05/30 00:13:33 UTC
[PR] Add draft project security threat-model document [cloudstack-kubernetes-provider]
potiuk opened a new pull request, #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97
## Summary
This PR adds an initial draft of a project-level security
threat-model document (`draft-THREAT-MODEL.md`) so that automated
security scanners running against this repository have a
maintainer-facing reference for which classes of findings are
in-scope vs. out-of-scope for the project.
The document follows the rubric format used by several other ASF
projects piloting improved security-model discoverability for
agentic scanners. Every claim carries a provenance tag:
- *(documented)* — paraphrased from public artefacts (this repo or
the project website), cited inline.
- *(inferred)* — synthesised from code structure or domain
knowledge; the PMC has not confirmed.
- *(maintainer)* — confirmed by a CloudStack PMC member in response
to this draft. (Zero in this initial draft.)
Draft stats:
- ~18 documented claims
- ~8 inferred claims (each maps to a §14 question)
- 12 open questions for maintainers in §14
§14 is the highest-leverage section: answering each question
either promotes one *(inferred)* tag to *(maintainer)* or corrects
the underlying claim.
## Scope note
This is a delta document inheriting from apache/cloudstack:draft-THREAT-MODEL.md. Notable finding: the CCM's CloudStack credentials are documented as non-rotatable (a Secret leak cannot be remediated by rotation without breaking the CCM) — surfaced as a §14 question.
## Why "draft-" prefix?
The file is named `draft-THREAT-MODEL.md` rather than
`SECURITY-THREAT-MODEL.md` because **this is a proposal for the
PMC to review — please correct, reject, or discuss as needed.**
Once the PMC ratifies (or substantially edits) the content, the
file can be renamed in a follow-up PR and a discoverability
scaffold (`AGENTS.md` → `SECURITY.md` → the model) added so
scanners can mechanically follow the chain.
## What this is, and what it is not
This is **not** a security audit. It is a working triage document
— the reference a triager holds against an inbound report to
decide whether the report is about a CloudStack-Kubernetes-Provider vulnerability or
about caller misuse / operator misconfiguration / an out-of-scope
concern.
The draft was generated by an automated agentic security scan
being piloted by the ASF Security team; the discoverability work
is independent of any specific scan run.
## How to review
1. §14 first. Each answer either confirms one *(inferred)* tag or
replaces the inferred claim with the correct one.
2. After that, please skim §3 (out-of-scope) and §13 (triage
dispositions) — those govern how a vulnerability report would
be triaged.
Reply edits / corrections inline on the PR, or to the original
`security@apache.org` thread, whichever fits the PMC's workflow.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security-model discoverability pointer to the project-wide CloudStack threat model [cloudstack-kubernetes-provider]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97#issuecomment-4627208915
Thanks @yadvr — routing to @DaanHoogland and @vishesh92 makes sense. These are just discoverability pointers to the project-wide model in #13293, so they'll naturally follow once that lands. Standing by for the leads' review — happy to reshape the pointers to match whatever #13293 settles on. No rush from our side.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security-model discoverability pointer to the project-wide CloudStack threat model [cloudstack-kubernetes-provider]
Posted by "vishesh92 (via GitHub)" <gi...@apache.org>.
vishesh92 commented on PR #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97#issuecomment-4955765047
Merging for now. We can revisit later if any changes are required here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add draft project security threat-model document [cloudstack-kubernetes-provider]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97#issuecomment-4580836858
## [Codecov](https://app.codecov.io/gh/apache/cloudstack-kubernetes-provider/pull/97?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 50.05%. Comparing base ([`4740dbc`](https://app.codecov.io/gh/apache/cloudstack-kubernetes-provider/commit/4740dbcacc7fc5892354b03b2f0be7ebf5c92584?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`0cea6d1`](https://app.codecov.io/gh/apache/cloudstack-kubernetes-provider/commit/0cea6d1ebdda23ac34f07e58e634b8fe1ef22965?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #97 +/- ##
=======================================
Coverage 50.05% 50.05%
=======================================
Files 4 4
Lines 975 975
=======================================
Hits 488 488
Misses 473 473
Partials 14 14
```
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/cloudstack-kubernetes-provider/pull/97?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add draft project security threat-model document [cloudstack-kubernetes-provider]
Posted by "yadvr (via GitHub)" <gi...@apache.org>.
yadvr commented on PR #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97#issuecomment-4590378965
There's a lot of details in the draft that needs a better set of eyes, so assigning @DaanHoogland @vishesh92 who're also PMC leads on the work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security-model discoverability pointer to the project-wide CloudStack threat model [cloudstack-kubernetes-provider]
Posted by "vishesh92 (via GitHub)" <gi...@apache.org>.
vishesh92 merged PR #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security-model discoverability pointer to the project-wide CloudStack threat model [cloudstack-kubernetes-provider]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #97:
URL: https://github.com/apache/cloudstack-kubernetes-provider/pull/97#discussion_r3568378686
##########
SECURITY.md:
##########
@@ -0,0 +1,35 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/cloudstack-kubernetes-provider` follows the [Apache Software Foundation security process](https://www.apache.org/security/).
+Please report suspected vulnerabilities privately to `security@apache.org`; do not
+open public GitHub issues or pull requests for security reports.
+
+## Threat Model
+
+`apache/cloudstack-kubernetes-provider` is part of the Apache CloudStack project and is covered by the
+**project-wide CloudStack threat model** rather than a per-repository copy. What the
+project treats as in scope and out of scope, the security properties it provides and
+disclaims, the adversary model, and how findings are triaged are documented in that
+model: <https://github.com/apache/cloudstack/blob/main/THREAT_MODEL.md>.
+
+(That link resolves once the project-wide model lands on `apache/cloudstack`'s
+`main` branch — see apache/cloudstack#13293. A thin `cloudstack-cloudstack-kubernetes-provider`-specific
+addendum can be added here later if this component needs one.)
Review Comment:
The referenced upstream file `https://github.com/apache/cloudstack/blob/main/THREAT_MODEL.md` does not exist on `apache/cloudstack` `main` right now (404), so this pointer would be broken if merged today. Also, the addendum name has a duplicated `cloudstack-` segment. Consider pointing to the currently existing upstream draft model until the canonical `THREAT_MODEL.md` lands, and fix the repo name in the addendum note.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org