jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
---
|
|
# The CVE page at cve.<domain>. Internal exposure only (docs/17 "Access"): a list of what is exploitable
|
|
# where is sensitive, so this hostname publishes NO public DNS record (the `controller: none` annotation
|
|
# below disowns it from external-dns) and the Cloudflare Tunnel 404s it (platform/cloudflared/config.yaml).
|
|
# It resolves on the LAN through PiHole's explicit list (catalog/pihole.yaml).
|
|
#
|
|
# The backend is the `vuln-scanner` Service's `http` port, which fronts the oauth2-proxy sidecar, so the
|
|
# SSO gate is in the data path; nothing routes to the page (:8080) directly.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: vuln-scanner
|
|
namespace: vuln-scanner
|
|
labels:
|
|
app.kubernetes.io/name: vuln-scanner
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: oauth2-proxy
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
external-dns.alpha.kubernetes.io/controller: "none"
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- cve.${BASE_DOMAIN}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: vuln-scanner
|
|
port: 4180
|