jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
34 lines
1.0 KiB
YAML
34 lines
1.0 KiB
YAML
---
|
|
# One Service, three named ports (the page gate, the internal API and metrics).
|
|
#
|
|
# clusterIP IS PINNED ON PURPOSE (10.43.210.10, verified unused against the live Service list on
|
|
# 2026-11-09, inside k3s' default 10.43.0.0/16 Service CIDR). The triage bot runs as a Gitea Actions
|
|
# job inside the runner's DinD daemon, and whether in-cluster DNS resolves from a DinD job container
|
|
# is UNVERIFIED. The pinned address is the bot's fallback when the Service name does not resolve:
|
|
# `http://10.43.210.10:8081` (VULN_API_FALLBACK_URL in .gitea/workflows/cve-triage.yaml).
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: vuln-scanner
|
|
namespace: vuln-scanner
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
spec:
|
|
type: ClusterIP
|
|
clusterIP: 10.43.210.10
|
|
selector:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
ports:
|
|
- name: http
|
|
port: 4180
|
|
targetPort: http
|
|
protocol: TCP
|
|
- name: internal
|
|
port: 8081
|
|
targetPort: internal
|
|
protocol: TCP
|
|
- name: metrics
|
|
port: 9090
|
|
targetPort: metrics
|
|
protocol: TCP
|