jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
20 lines
670 B
YAML
20 lines
670 B
YAML
---
|
|
# The report store: state.json (firstSeenAt, failed-since, heartbeat, last complete run) and
|
|
# report.json. 1Gi on the replicated tier is generous for two JSON files; it is DELIBERATELY NOT where
|
|
# the vulnerability database or the per-image scan caches live, because etcd and Longhorn share a
|
|
# partition on every node (docs/02, docs/17 "Load"). Those are on the size-limited /cache emptyDir.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: vuln-scanner-data
|
|
namespace: vuln-scanner
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|