jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
35 lines
1.6 KiB
YAML
35 lines
1.6 KiB
YAML
# =============================================================================
|
|
# L0 STATIC — the CVE scanner's supply chain and privileges are what docs/17 "Security of the scanner
|
|
# itself" says (R-VULN-09). Offline, no cluster.
|
|
#
|
|
# WHY SCOPE, NOT REQUIREMENTS: the property spans platform/vuln-scanner and renovate.json5. A
|
|
# requirement-scoped selection would miss a Renovate edit that quietly lets the scanner auto-merge.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vuln-scanner-supply-chain
|
|
labels:
|
|
conformance.home.k3s/R-VULN-09: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-VULN-09"
|
|
conformance.home.k3s/layer: "L0"
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
The scanner image is pinned by digest and is not a banned Trivy version; Renovate never
|
|
auto-merges it and proposes it only after 7 days; its RBAC holds get/list/watch only and no
|
|
Secret; the pod is unprivileged with bounded resources and a size-limited cache. Each is
|
|
proven by mutation.
|
|
spec:
|
|
steps:
|
|
- name: assert-supply-chain-and-privileges
|
|
description: >-
|
|
Parse platform/vuln-scanner/deployment.yaml, rbac.yaml and renovate.json5, assert the
|
|
digest/version/Renovate/RBAC/security-context contract, and run each evaluator on mutated
|
|
copies to prove it can fail.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|