jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
41 lines
1.8 KiB
YAML
41 lines
1.8 KiB
YAML
# =============================================================================
|
|
# L3 FAULT-INJECTION SCAFFOLD — breaking registry access produces failed targets and the coverage alert (R-VULN-03, R-VULN-06)
|
|
# Catalog: docs/17 "Acceptance gates" (L3).
|
|
#
|
|
# With registry access broken for one image, that target becomes failed with its reason, prior findings are retained, and VulnCoverageGap fires after 24h.
|
|
#
|
|
# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
|
|
# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vuln-registry-failure
|
|
labels:
|
|
conformance.home.k3s/R-VULN-03: "true"
|
|
conformance.home.k3s/R-VULN-06: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-VULN-03, R-VULN-06"
|
|
conformance.home.k3s/layer: "L3"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/intent: >-
|
|
With registry access broken for one image, that target becomes failed with its reason, prior findings are retained, and VulnCoverageGap fires after 24h.
|
|
spec:
|
|
steps:
|
|
- name: given-a-scanned-target
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: record a scanned target and its findings"'
|
|
- name: when-registry-access-is-broken
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: inject a fault blocking that registry"'
|
|
- name: then-target-failed
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: assert state failed, reason present, findings retained, run continues"'
|
|
- name: then-coverage-alert-fires
|
|
try:
|
|
- script:
|
|
content: 'echo "TODO: assert VulnCoverageGap fires once the failure passes 24h"'
|