jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
42 lines
1.9 KiB
YAML
42 lines
1.9 KiB
YAML
---
|
|
# Flux Kustomization: the CVE visibility scanner (docs/17, ADR-0027) — reconciles ./platform/vuln-scanner.
|
|
#
|
|
# ISOLATION IS THE POINT, as for clusters/base/cloudflared.yaml. A failing scanner, an unbound PVC or a
|
|
# pending Certificate must never become a stalled platform, so:
|
|
# * ITS OWN Kustomization, not a line in platform/kustomization.yaml;
|
|
# * wait: false — its health is reported by the VulnScanStale/VulnDatabaseStale/VulnCoverageGap/
|
|
# VulnCriticalFixAvailable/VulnTriageBotSilent alerts (platform/vuln-scanner/alerts.yaml), not by
|
|
# this object's Ready condition, which reaches Ready on apply success;
|
|
# * NOTHING dependsOn THIS. conformance/tests/l0-static/vuln-scanner-isolation fails the gate if any
|
|
# Kustomization gains `dependsOn: vuln-scanner` or this one stops being wait:false.
|
|
#
|
|
# dependsOn: [platform-config] — a real edge: PrometheusRule/ServiceMonitor/Gateway API CRDs, the
|
|
# Longhorn StorageClass, the Gateway, Keycloak's realm, and Longhorn itself come up through
|
|
# `platform`/`platform-config` first.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: vuln-scanner
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
retryInterval: 2m
|
|
timeout: 5m
|
|
prune: true
|
|
wait: false
|
|
dependsOn:
|
|
- name: platform-config
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: flux-system
|
|
path: ./platform/vuln-scanner
|
|
# REQUIRED: the HTTPRoute hostname, the oauth2-proxy issuer/redirect/cookie-domain args and every
|
|
# alert's runbook_url are written `${BASE_DOMAIN}`. Substitution fails OPEN, so the file
|
|
# conformance/tests/l0-static/flux-postbuild-substitution audits this tier.
|
|
postBuild:
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: cluster-vars
|
|
# SOPS decryption is layered per-environment: clusters/dev and clusters/prod each patch THIS
|
|
# Kustomization by name with a `decryption:` stanza for the oauth2-proxy credentials.
|