POC: Evaluate PolicyReport CRD by Kubernetes wg-policy

[danielpacak]

Starboard is using proprietary VulnerabilityReport CRD to represent weaknesses found in container images. As an alternative or replacement we may consider PolicyReport.

In scope of this POC we should evaluate PolicyReport CRD by mapping Trivy JSON output to PolicyReport schema and identify any issues / limitations.

/cc @itaysk

[krol3]

I'd like to try it

[danielpacak]

Great @krol3 ! Notice that I opened kubernetes-sigs/wg-policy-prototypes#79 to allow importing wg-policy as Go module. However, just to try things out we could temporarily copy structures defined in https://github.com/kubernetes-sigs/wg-policy-prototypes/blob/master/policy-report/api/v1alpha2/policyreport_types.go directly into our source code tree and regenerate code as explained in Generate code.

[krol3]

Thnaks @danielpacak , is this POC related to this issue? kubernetes-sigs/wg-policy-prototypes#57

[danielpacak]

Thnaks @danielpacak , is this POC related to this issue? kubernetes-sigs/wg-policy-prototypes#57

Somehow yes. The main difference though is that we can try it out in Starboard repository very easily without waiting for all discussions to be resolved by WG Policy. On the other hand the intent is to collaborate with the WG folks and share our experience with this POC.

For this project stand point we want to confirm that the PolicyReport schema is sufficient to replace VulnerabilityReport.