From a5f32e3664f82034f14cc0906fb96afd9693eb88 Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Tue, 14 Jul 2026 16:56:54 -0700 Subject: [PATCH 1/3] roles: Split security team by areas Following discussion with Peter about how to manage the current wave of security reports across the organization, I thought it may be useful to establish three teams with clear responsibilities. The security team overall will be a superset of these teams, then these teams can determine internally how to handle security response within their specific domains (overall response, general cilium, and tetragon). Signed-off-by: Joe Stringer --- CODEOWNERS | 4 ++- ladder/reviewers.yaml | 1 + ladder/teams/security-org.yaml | 5 ++++ ladder/teams/security-tetragon.yaml | 3 +++ ladder/teams/security.yaml | 11 +++++--- roles/Security-Team.md | 39 +++++++++++++++++------------ 6 files changed, 42 insertions(+), 21 deletions(-) create mode 100644 ladder/teams/security-org.yaml create mode 100644 ladder/teams/security-tetragon.yaml diff --git a/CODEOWNERS b/CODEOWNERS index 0aad89b..2f24f6f 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -36,7 +36,9 @@ /ladder/teams/proxy.yaml @cilium/proxy /ladder/teams/pwru.yaml @cilium/pwru /ladder/teams/release-managers.yaml @cilium/release-managers -/ladder/teams/security.yaml @cilium/security +/ladder/teams/security-cilium.yaml @cilium/security-cilium +/ladder/teams/security-org.yaml @cilium/security-org +/ladder/teams/security-tetragon.yaml @cilium/security-tetragon /ladder/teams/sig-agent.yaml @cilium/sig-agent /ladder/teams/sig-bgp.yaml @cilium/sig-bgp /ladder/teams/sig-cilium-cli.yaml @cilium/sig-cilium-cli diff --git a/ladder/reviewers.yaml b/ladder/reviewers.yaml index a786522..eb19109 100644 --- a/ladder/reviewers.yaml +++ b/ladder/reviewers.yaml @@ -68,6 +68,7 @@ reviewers: - paularah - paulcacheux - pchaigno +- peoyekunle - pippolo84 - qmonnet - rastislavs diff --git a/ladder/teams/security-org.yaml b/ladder/teams/security-org.yaml new file mode 100644 index 0000000..2f209b6 --- /dev/null +++ b/ladder/teams/security-org.yaml @@ -0,0 +1,5 @@ +members: +- aanm +- ferozsalam +- joestringer +- peoyekunle diff --git a/ladder/teams/security-tetragon.yaml b/ladder/teams/security-tetragon.yaml new file mode 100644 index 0000000..ba6b87d --- /dev/null +++ b/ladder/teams/security-tetragon.yaml @@ -0,0 +1,3 @@ +members: +- mtardy +- kkourt diff --git a/ladder/teams/security.yaml b/ladder/teams/security.yaml index ff4a18f..945d2ac 100644 --- a/ladder/teams/security.yaml +++ b/ladder/teams/security.yaml @@ -1,10 +1,13 @@ members: - aanm -- borkmann -- brb -- ferozsalam +- christarazi +- gandro - joestringer - jrajahalme -- mtardy +- julianwiedmann +- nebril - nezdolik +- pchaigno - rolinh +- sayboras +- youngnick diff --git a/roles/Security-Team.md b/roles/Security-Team.md index 58ed01a..bf637ad 100644 --- a/roles/Security-Team.md +++ b/roles/Security-Team.md @@ -1,19 +1,26 @@ # Security Team -The security team roles and responsibilities are listed in [CONTRIBUTOR-ROLES.md](/CONTRIBUTOR-ROLES.md#security-team). The following are the current security team members: +The security team roles and responsibilities are listed in +[CONTRIBUTOR-ROLES.md](/CONTRIBUTOR-ROLES.md#security-team). -* [André Martins](https://github.com/aanm) -* [Daniel Borkmann](https://github.com/borkmann) -* [Feroz Salam](https://github.com/ferozsalam) -* [Jarno Rajahalme](https://github.com/jrajahalme) -* [Joe Stringer](https://github.com/joestringer) -* [John Fastabend](https://github.com/jrfastab) -* [Julian Wiedmann](https://github.com/julianwiedmann) -* [Kateryna Nezdolii](https://github.com/nezdolik) -* [Kyle Simmons](https://github.com/kyle-c-simmons) -* [Liz Rice](https://github.com/lizrice) -* [Martynas Pumputis](https://github.com/brb) -* [Maciej Kwiek](https://github.com/nebril) -* [Peter Oyekunle](https://github.com/peoyekunle) -* [Sebastian Wicki](https://github.com/gandro) -* [Tam Mach](https://github.com/sayboras) +The following teams are the current security team members: + +* [security-org](/ladder/teams/security-org.yaml) handles communications, + security response, triage and provides oversight; +* [security](/ladder/teams/security.yaml) provides technical assistance with + managing security vulnerabilities broadly across the Cilium organization, + with a particular focus on the `cilium/cilium` subproject. +* [security-tetragon](/ladder/teams/security-tetragon.yaml) provides technical + assistance to manage security vulnerabilities for the `cilium/tetragon` + subproject. + +## Adding new members + +When adding new members to these teams, the proposed members must satisfy the +criteria defined in the contributor roles. When a new member is added to the +team through a PR to this repository, the following memberships may need to +be updated: + +* Synchronize GitHub state with this repository +* Update security mailinglist membership +* Cilium security team Slack channel membership From 59b08c39429021792d7e9bebde9a6b0f707717ca Mon Sep 17 00:00:00 2001 From: Kornilios Kourtis Date: Thu, 16 Jul 2026 12:02:05 +0200 Subject: [PATCH 2/3] tetragon-security: add Jiri and Kevin Signed-off-by: Kornilios Kourtis --- ladder/teams/security-tetragon.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ladder/teams/security-tetragon.yaml b/ladder/teams/security-tetragon.yaml index ba6b87d..f1946df 100644 --- a/ladder/teams/security-tetragon.yaml +++ b/ladder/teams/security-tetragon.yaml @@ -1,3 +1,5 @@ members: -- mtardy +- kevsecurity - kkourt +- mtardy +- olsajiri From 079afd53750359ba96aa99f945da2e3df957e99f Mon Sep 17 00:00:00 2001 From: Joe Stringer Date: Tue, 21 Jul 2026 16:08:18 -0700 Subject: [PATCH 3/3] Rename security team to security-cilium This reflects the more narrow default scope for this team (primarily focused on the Cilium subproject). Signed-off-by: Joe Stringer --- ladder/teams/{security.yaml => security-cilium.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename ladder/teams/{security.yaml => security-cilium.yaml} (100%) diff --git a/ladder/teams/security.yaml b/ladder/teams/security-cilium.yaml similarity index 100% rename from ladder/teams/security.yaml rename to ladder/teams/security-cilium.yaml