job-builder: introduced secure base-job-image

[mivanov1988]

What

As part of our initiative to improve the overall security of the VDK project, we need to apply some general hardenings to the base job image.

Why

Introduced base job image based on the lightweight Photon OS. The general hardenings will be applied in a separate PR.

Testing done

Tested on a local Kind cluster

Signed-off-by: Miroslav Ivanov [email protected]

[murphp15]

can we remove the insecure image? To keep the code clean?
Is there are use case for the insecure one?

[mivanov1988]

can we remove the insecure image? To keep the code clean? Is there are use case for the insecure one?

Some of our internal deployments depend on it.

[murphp15]

Can they migrate to the secure ones soon though?

[mivanov1988]

Can they migrate to the secure ones soon though?

It is not planned yet.

[antoniivanov]

What are the benefits of photon vs python-slim (which is the default one) ?

In any case looks good to me. Offering more secure option is certainly a good thing.

[mivanov1988]

One of the key features of interest of the Photon OS is: "The kernel and other aspects of the operating system are built with an emphasis on security.".

On scanning the Photon OS image, the vulnerabilities are as follows: Tested 35 dependencies for known issues, no vulnerable paths found.

On scanning python:3.10-slim the vulnerabilities are as follows: Tested 106 dependencies for known issues, found 47 issues.

[antoniivanov]

One of the key features of interest of the Photon OS is: "The kernel and other aspects of the operating system are built with an emphasis on security.".

On scanning the Photon OS image, the vulnerabilities are as follows: Tested 35 dependencies for known issues, no vulnerable paths found.

On scanning python:3.10-slim the vulnerabilities are as follows: Tested 106 dependencies for known issues, found 47 issues.

Thanks. That make sense.