Virtual Machine Image Endorsement

Goal

Set up a process assuring that a Virtual Machine Image (VMI)/ Virtual Appliance (VA) published in AppDB is well-configured, secure and up-to-date.

Image types

Type	Description	Managed by
EGI	General purpose images. Based on largely used Oses	EGI
VO-specific	VO specific images, available to a specific VO and customized for specific purposes	VO-expert

Activities

Activity	Description
A1. Image setup	Set up an image ready to be used by a Resource Provider
A2. Image hardening	Procedure that provides first configuration, security and updates to a given image output of A1
A3. Image publishing	Procedure that takes and image ready from A2 and makes it available on AppDB with proper tags, metadata, links

Documents and Policies

Policies are defined by the SPG group and are published in the https://wiki.egi.eu/wiki/SPG:Documents

It is particularly relevant the Security Policy for the Endorsement and Operation of Virtual Machine Images and a draft of a Virtualisation Policy.

SPG Drafts under development

Procedures

EGI core VM endorsement

Here the endorsement of the "core" EGI VM images is shown in detail. 

Activity

Enol Fernandéz will set up the workflow and establish the procedure; Vincenzo will take care of the endorsement and give feedback to the procedure.

A security expert is needed to suggest technical checks to be done on the VMs; they can be automated or not; they assure compliance of a given VM to EGI recommendations. Start here: https://wiki.egi.eu/wiki/SPG:Drafts:Virtualisation_Policy

Images to support as EGI.eu

Ubuntu LTS, CentOS6, CentOS7. Update frequency at the moment is "monthly or triggered by security issues"

Communication/documentation:

SSO group available: vm-image-endorsement. Also GDoc available with the "big discussion" (as Vincenzo).

VO VM endorsement (and pilot)

EGI will involve the VOs, inviting them to insert/update their images, following the new guidelines and accepting the relevant policies. EGI can give support especially in the first round of creation of the VO images.

Educating VM/VA preparators on how to prepare secure images. Documentation from the first step (preparation of the VM) is needed, and security advisories/recommendations/procedures.