Improve security hygiene and documentation

[ricardoapl]

What would you like to be added:

Similar to what was proposed in kubernetes-sigs/prometheus-adapter#638 for prometheus-adapter, I suggest we implement the following for metrics-server:

• Generating an SBOM automatically when a new release is tagged, so that users have a better understanding of whether or not they're affected by a particular vulnerability
• Generating SLSA/provenance attestation automatically for each new release, so that users can verify the authenticity and trustworthiness of the build process
• Initializing VEX feed and generating OpenVEX data on each release, so that users have a better understanding of which vulnerabilities present a genuine risk

We should probably also follow up on CLOMonitor security checks previously configured in cncf/clomonitor#1407:

• https://clomonitor.io/projects/cncf/metrics-server#metrics-server_security

Why is this needed:

I believe this relates to https://github.com/kubernetes/sig-release/blob/193a3cdf8d73e0888c7f6829eea3716918a5af4a/roadmap.md

/kind feature

[k8s-ci-robot]

This issue is currently awaiting triage.

If metrics-server contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dgrisonnet]

@ricardoapl you mentioned over on Slack that Manuel had done the CLOMonitor integration. Is there anything more to do?

[ricardoapl]

Yes, I suggest the following based on Security Slam: Kubernetes Lightning Round

Release to Community Infrastructure

• Task 1: Releases are being made via CI (Add cloudbuild.yaml #460)
• Task 2: Check that Images are Staged and Promoted Using Community Infra (Add kube-state-metrics staging repo kubernetes/k8s.io#384)

Automate Security Documentation

• Task 3: Ensure SBOMs are Generated by Kubernetes BOM
• Task 4: Ensure SLSA Attestations are Generated when Possible
• Task 5: Ensure the Project has a VEX Feed

CLOMonitor: Secure Development Practices

• Task 7: Set up CLOMonitor Tracking (Add metrics-server to projects cncf/clomonitor#1407)
• Task 8: Check for Binary Artifacts (no binaries found in the repo)
• Task 9: Review the Code Review (all changesets reviewed)
• Task 10: Dangerous Workflow (no dangerous workflow patterns detected)
• Task 11: Security Insights
• Task 12: Dependencies Policy
• Task 13: Dependency update tool (update tool detected, dependabot)
• Task 15: Token Permissions