jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
21 lines
628 B
YAML
21 lines
628 B
YAML
---
|
|
# Prometheus scrape of the aggregate-only /metrics (:9090). Only the `metrics` port of the shared
|
|
# Service; networkpolicy.yaml admits only Prometheus on it. kube-prometheus-stack selects
|
|
# ServiceMonitors from any namespace; the `release` label is kept for consistency.
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: vuln-scanner
|
|
namespace: vuln-scanner
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
release: kube-prometheus-stack
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
endpoints:
|
|
- port: metrics
|
|
path: /metrics
|
|
interval: 60s
|