✈️ Devise new image upload system (including image scanning)

[jhpyke]

User Story

As an… Airflow Maintainer
I need/want/expect to… have users upload images to airflow that are secure
So that… I can run a platform where we are confident that user code is safe to execute.

Value / Purpose

Users can currently upload images they build themselves, which allows users to self-service update their images while in development. In order to continue to follow best practice, we should create an image upload mechanism that surfaces security outcomes to users directly, so they can act on the information provided.

Useful Contacts

No response

User Types

No response

Hypothesis

No response

Proposal

No response

Additional Information

This is the current image upload mechanism. It functions by having repository level secrets stored in the template r and python repos, which then are available in user repositories based on this repo. This code is largely unchanged since its inception, and should be used as a reference, and not a template for the future action.

Definition of Done

• Users are able to upload images that are accessible from within the new airflow environment.
• Images are scanned prior to upload, and any security issues of HIGH or CRITICAL status are returned back to them.
• Images with CRITICAL security issues are prevented from being uploaded to our ECR repositories.
• A decision should be made on whether to allow images with HIGH status security issues.

[github-actions]

This issue is being marked as stale because it has been open for 60 days with no activity. Remove stale label or comment to keep the issue open.

[github-actions]

This issue is being closed because it has been open for a further 7 days with no activity. If this is still a valid issue, please reopen it, Thank you!