Score documentation

[naseemkullah]

Hello,

After following recommendations from kubesec, most of my deployments get a score of 9 without any further recommendations, however there is a deployment that gets a score of 12.
Without extra notes, I cannot determine the difference between the deployments that score 9 and those that score 12.

Thank you!

[stefanprodan]

@sublimino is there any documentation available on how the score gets computed

[sublimino]

It's currently "Andy's Kubernetes threat model", so certainly deserves scrutiny.

It's internally modelled as (+/-ve) points, but that could be renamed riskScore (or riskModifier etc) - any preference @stefanprodan? If we agree a key name I'll expose it in the response.

[stefanprodan]

riskScore sounds good to me :)

[naseemkullah]

May I suggest secScore ? Seeing that the more points you score the less risk you have, the more secure your resource is.

[sublimino]

Good point @naseemkullah! Will have a muse before I do it...