Adding security self-assesment for project K3s

[OrlinVasilev]

Adding the K3s security self-assesment as advised by @eddie-knight cncf/tag-security#1500 (comment)

[OrlinVasilev]

@eddie-knight PTAL ^^ Thanks!

[JustinCappos]

FYI: The contents of the assessment were reviewed and approved from the prior PR. cncf/tag-security#1500 (review)

[OrlinVasilev]

@eddie-knight @JustinCappos is there anything else we need to get this in? thank you!

[eddie-knight]

@OrlinVasilev This is approved by the TAG, but must be merged by the TOC per the codeowner enforcement

[OrlinVasilev]

Thank you!

[JustinCappos]

@OrlinVasilev This is approved by the TAG, but must be merged by the TOC per the codeowner enforcement

@mnm678 @jkjell @evankanderson , can you help us move this along?

[jkjell]

If we move the assessment to a sub-directory called security-assessment under the k3s directory, the TAG leads should be able to fully approve and merge.

https://github.com/cncf/toc/blob/main/.github/CODEOWNERS#L40

[kfaseela]

Thanks for the PR! Just left a few small nits. Otherwise LGTM

[kfaseela]

RBAC and Pod Security Admission are correctly identified as critical security functions. Per the TAG Security self-assessment guidance, these could optionally be framed more explicitly in threat-modeling terms (e.g., threats mitigated such as unauthorized access or privilege escalation), not mandatory - just a suggestion.

[kfaseela]

Just one more small comment from me @OrlinVasilev . Once done, I will merge!

[OrlinVasilev]

@kfaseela done! Thank you!

[kfaseela]

Thanks for your patience @OrlinVasilev !

[OrlinVasilev]

Hurray Thank you @kfaseela !!!