2024-08-27 Meeting notes [lifecycle of identity]

IaC scan

• Do an IaC of existing Nephio repos and identify findings?

• Present the scan results to the SIG

• IDentify action items to fix the problem

• Operationalize the execution of the scanning tool itself.

SPIFFE document

@Rahul Jadhav

Send the document for initial review to SIG-Security

Vault policies as CRDs

@Prashant

• Using k8s CRDs for Vault policies

• Automation of the vault policies

• Check if we could use GitHub - redhat-cop/vault-config-operator: An operator to support Haschicorp Vault configuration workflows from within Kubernetes