jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
---
|
|
# The CVE visibility scanner (docs/17, ADR-0027). Reconciled by its OWN non-gating Flux Kustomization
|
|
# (clusters/base/vuln-scanner.yaml: dependsOn platform-config, wait:false). A scanner that is failing,
|
|
# or a pod that cannot get its report store, is a thing to alert on, never a thing that stalls the
|
|
# platform. NOT a line in platform/kustomization.yaml.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Required for the configMapGenerator (see platform/cloudflared/kustomization.yaml).
|
|
namespace: vuln-scanner
|
|
resources:
|
|
- namespace.yaml
|
|
- rbac.yaml
|
|
- pvc.yaml
|
|
# The per-pod oauth2-proxy credential. SOPS-encrypted, decrypted per-env by the vuln-scanner
|
|
# Kustomization (both overlays patch it). Referenced by name only (R-IDP-04). Its template sibling
|
|
# is deliberately not named here (no-plaintext-secrets).
|
|
- vuln-scanner-oauth2-proxy-credentials.sops.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
# Namespace default-deny, the three ingress paths and the egress allowances. One file, so a baseline
|
|
# without its allows cannot ship alone and empty the TSDB.
|
|
- networkpolicy.yaml
|
|
- httproute.yaml
|
|
- servicemonitor.yaml
|
|
- alerts.yaml
|
|
|
|
# Scanner source and the risk-acceptance file, both as content-hashed ConfigMaps, so a change rolls
|
|
# the pod. No `disableNameSuffixHash`: the hash is the rollout mechanism.
|
|
configMapGenerator:
|
|
- name: vuln-scanner-src
|
|
files:
|
|
- src/main.py
|
|
- src/inventory.py
|
|
- src/trivy.py
|
|
- src/state.py
|
|
- src/report.py
|
|
- src/acceptances.py
|
|
- src/page.py
|
|
- src/metrics.py
|
|
- src/server.py
|
|
- src/report.schema.json
|
|
options:
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
- name: vuln-scanner-acceptances
|
|
files:
|
|
- acceptances.yaml
|
|
options:
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|