From 28a1c0a2ebdb583edc5835051154bad24bad29a4 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 9 Nov 2026 12:52:03 -0600 Subject: [PATCH] docs(17): resolve two implementation escalations on registry state and SSO egress credential-required now comes from a declared registry list, because LAN egress is excluded and the scanner could never receive a refusal from the private registry. The egress list now names the Gateway and identity provider, which the SSO sidecar needs. Co-Authored-By: Claude Opus 5.5 --- docs/17-vulnerability-visibility.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/17-vulnerability-visibility.md b/docs/17-vulnerability-visibility.md index 05df1b2..01804f2 100644 --- a/docs/17-vulnerability-visibility.md +++ b/docs/17-vulnerability-visibility.md @@ -91,7 +91,7 @@ Every inventoried target has exactly one state: | `pending` | Discovered and not yet scanned, within the 2-hour window. | | `stale` | Last successful scan is older than the 24-hour window. Prior findings are retained and labelled stale. | | `failed` | The most recent attempt failed. The reason is shown. Prior findings are retained. | -| `credential-required` | The registry refused anonymous access. Shown with the registry. | +| `credential-required` | The image is on a registry declared as needing a credential the scanner does not hold. Shown with the registry. A declared list is used because the private registry sits on the LAN, which the scanner's egress excludes, so it would otherwise surface as a network failure. | | `by-tag` | Scanned by mutable reference, because no running digest exists. | | `not-covered` | A target class this scanner cannot examine: VMs and nodes. | @@ -244,8 +244,9 @@ compromised in March 2026 ([CVE-2026-33634](https://nvd.nist.gov/vuln/detail/CVE **nothing else**. It MUST NOT read Secrets or hold any write verb on the Kubernetes API. - It holds no git credential and no registry credential. - Network: ingress only from the Gateway for the page, from CI for the internal API and from - Prometheus for metrics. Egress only to the Kubernetes API, DNS, and TCP/443 on the public internet, - with cluster and LAN ranges excluded, through the direct path. + Prometheus for metrics. Egress only to the Kubernetes API, DNS, the platform Gateway and identity provider (required by the + SSO sidecar), and TCP/443 on the public internet, with cluster and LAN ranges otherwise excluded, + through the direct path. - It runs unprivileged, with a read-only root filesystem and no host namespaces or mounts. - The scanner's own images appear in the report like any other.