jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
24 lines
1.1 KiB
YAML
24 lines
1.1 KiB
YAML
---
|
|
# vuln-scanner — the CVE visibility scanner (R-VULN-01..09, ADR-0027, docs/17). Hand-authored platform
|
|
# delivery tooling, not a catalog service: its cluster-wide read identity is something a
|
|
# ServiceDefinition cannot express.
|
|
#
|
|
# gateway-access=shared opts this namespace in to attach the cve.<domain> HTTPRoute to the shared
|
|
# Gateway; the route targets the per-pod oauth2-proxy sidecar (:4180), never the page directly.
|
|
#
|
|
# INTENTIONALLY NOT homelab.keithjackson.dev/app-namespace=true (the crafty/cloudflared/pm-agent
|
|
# posture): every Kyverno app policy matches on that label, and the generated default-deny would then
|
|
# be double-owned with the one this tree ships (networkpolicy.yaml), the 2026-09-30 drift loop. The
|
|
# pod still carries the egress-class and auth-mode labels those policies would require.
|
|
#
|
|
# PodSecurity `restricted` IS enforced: nothing here needs any privilege.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: vuln-scanner
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
gateway-access: "shared"
|
|
pod-security.kubernetes.io/enforce: restricted
|
|
pod-security.kubernetes.io/enforce-version: latest
|