jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
---
|
|
# Scanner identity (R-VULN-09). The whole of its Kubernetes reach is get/list/watch on the objects it
|
|
# needs to answer "what is running, and which workload owns it". NO Secret, NO write verb, no
|
|
# wildcard. conformance/tests/l0-static/vuln-scanner-supply-chain fails the gate if that changes.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: vuln-scanner
|
|
namespace: vuln-scanner
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: vuln-scanner-read
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
rules:
|
|
# Running images, their digests, and the nodes a pod sits on (nodes are inventoried as not-covered).
|
|
- apiGroups: [""]
|
|
resources: [pods, nodes]
|
|
verbs: [get, list, watch]
|
|
# The owner chain Pod -> ReplicaSet -> Deployment, and the other two top-level controllers.
|
|
- apiGroups: [apps]
|
|
resources: [replicasets, deployments, statefulsets, daemonsets]
|
|
verbs: [get, list, watch]
|
|
# Pod -> Job -> CronJob, and CronJob templates with no running pod.
|
|
- apiGroups: [batch]
|
|
resources: [jobs, cronjobs]
|
|
verbs: [get, list, watch]
|
|
# KubeVirt VMs are inventoried as not-covered.
|
|
- apiGroups: [kubevirt.io]
|
|
resources: [virtualmachineinstances]
|
|
verbs: [get, list, watch]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: vuln-scanner-read
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: vuln-scanner-read
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: vuln-scanner
|
|
namespace: vuln-scanner
|