Update the roadmap and vision to reflect the current state

[saschagrunert]

What type of PR is this:

/kind documentation

What this PR does / why we need it:

• Added SLSA compliance deliverable
• Use a new section Done Deliverables for closed topics.
• Remove the status tracking at the end.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

We should send out a note to the mailing list after this has been done.

[justaugustus]

@saschagrunert -- Thanks for the updates!

One thing I think worth calling out (in "Known Risks" maybe) is that the SLSA framework is in earlier stages and changes to it can/may affect some of the direction of roadmap items.

Additionally, that we intend to partner and provide feedback on the framework.
With that in mind, it may be worth editing "fully SLSA-compliant" to less restrictive phrasing?

[PushkarJ]

Great to see this !! Speaking on behalf of SIG Security Friends, we look forward to helping SIG Release get towards SLSA compliance with code and non-code contributions :) cc @puerco

Personally, I am very interested in 5 and 9 deliverables ✨

[justaugustus]

/priority important-soon
/hold for additional reviews from @kubernetes/sig-release-leads (and addressing feedback)

[saschagrunert]

Rephrased the SLSA topic and added the known risk. ✔️

[dims]

@saschagrunert repeating the question @lachie83 asked on slack here - https://kubernetes.slack.com/archives/C2C40FMNF/p1633713488372400?thread_ts=1633618860.356500&cid=C2C40FMNF

Are you raising KEPs for these deliverables? It looks like a lot of them should require a KEP.

Looks like @PushkarJ thinks @kubernetes/sig-security may be interested as well?

[reylejano]

Adding on to @dims comment, I understand this is a SIG Release roadmap so this may not be applicable, do we want to mention efforts from @PushkarJ and sig-security-tooling e.g. Go vulndb, snyk scanning which are tracked in umbrella issue kubernetes/sig-security#3

[justaugustus]

@saschagrunert repeating the question @lachie83 asked on slack here - https://kubernetes.slack.com/archives/C2C40FMNF/p1633713488372400?thread_ts=1633618860.356500&cid=C2C40FMNF

Are you raising KEPs for these deliverables? It looks like a lot of them should require a KEP.

Looks like @PushkarJ thinks @kubernetes/sig-security may be interested as well?

Absolutely! We'll be working on tying all of the threads together with KEPs post-KubeCon.
We'll rope in participating SIGs as those drafts get opened. :)

[justaugustus]

Absolutely! We'll be working on tying all of the threads together with KEPs post-KubeCon. We'll rope in participating SIGs as those drafts get opened. :)

Opened this issue to track: #1724

Adding on to @dims comment, I understand this is a SIG Release roadmap so this may not be applicable, do we want to mention efforts from @PushkarJ and sig-security-tooling e.g. Go vulndb, snyk scanning which are tracked in umbrella issue kubernetes/sig-security#3

@reylejano -- Let's mention those as necessary in the relevant KEPs, but leave them off of the roadmap until needed (since we're not the owning SIG).

[justaugustus]

Thanks for the tweaks, @saschagrunert!
/hold cancel

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justaugustus,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment