docs: specify automated vulnerability visibility (R-VULN-*, ADR-0027) #4

2026-11-09T15:21:52Z

gitea-admin commented

2026-11-09 15:21:52 +00:00

Adds the specification for automated CVE visibility of what production actually runs.

New: docs/17-vulnerability-visibility.md, ADR-0027 (accepted on merge), requirements R-VULN-01..09, Phase 8.
Cross-references only: docs/10, 11, 12, 14, 16, glossary, README, ADR index.

The design in brief

A scheduled scanner in the cluster reads the running digests from the Kubernetes API, scans each unique digest with Trivy, and writes one versioned report.
An SSO page (platform-admins) lists each CVE against its images, containers and workloads, plus a full inventory.
"Not scanned" is a visible state on every surface, never zero findings.
A Renovate-shaped CI bot keeps a counts-only dashboard issue and asks Renovate to open updates. Renovate stays the only author of version changes.

Decisions driven by measurement (2026-11-09)

Measured	Consequence
Prometheus: 427k series, ~2.75 of 3 GiB	No per-CVE metrics, so the listing is not a Grafana dashboard
etcd shares a disk with Longhorn, and its metrics are not scraped	Trivy Operator's per-workload CRDs rejected
259 containers, 98 digests	Scan by digest and map back
Implementation repo is readable without authentication	The dashboard issue carries aggregates only
Trivy compromised March 2026 (CVE-2026-33634)	Digest pin, no auto-merge, 7-day minimum release age, banned versions

Merge notes

PR #3 also adds a row at the end of the ADR index, so whichever merges second has a one-line conflict in decisions/README.md. ADR-0026 belongs to #3, which is why this is 0027.
The implementation needs a ci/SPEC_PIN bump to this merge commit.

🤖 Generated with Claude Code

Adds the specification for automated CVE visibility of what production actually runs. **New:** `docs/17-vulnerability-visibility.md`, ADR-0027 (accepted on merge), requirements `R-VULN-01..09`, Phase 8. **Cross-references only:** docs/10, 11, 12, 14, 16, glossary, README, ADR index. ## The design in brief - A scheduled scanner in the cluster reads the running digests from the Kubernetes API, scans each unique digest with Trivy, and writes one versioned report. - An SSO page (`platform-admins`) lists each CVE against its images, containers and workloads, plus a full inventory. - "Not scanned" is a visible state on every surface, never zero findings. - A Renovate-shaped CI bot keeps a counts-only dashboard issue and asks Renovate to open updates. Renovate stays the only author of version changes. ## Decisions driven by measurement (2026-11-09) | Measured | Consequence | |---|---| | Prometheus: 427k series, ~2.75 of 3 GiB | No per-CVE metrics, so the listing is not a Grafana dashboard | | etcd shares a disk with Longhorn, and its metrics are not scraped | Trivy Operator's per-workload CRDs rejected | | 259 containers, 98 digests | Scan by digest and map back | | Implementation repo is readable without authentication | The dashboard issue carries aggregates only | | Trivy compromised March 2026 (CVE-2026-33634) | Digest pin, no auto-merge, 7-day minimum release age, banned versions | ## Merge notes - PR #3 also adds a row at the end of the ADR index, so whichever merges second has a one-line conflict in `decisions/README.md`. ADR-0026 belongs to #3, which is why this is 0027. - The implementation needs a `ci/SPEC_PIN` bump to this merge commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-11-09 15:21:52 +00:00

docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027) 0fb44bb0a8

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

gitea-admin referenced this pull request from Home-Network/home-network-k3s-impl

2026-11-09 18:41:24 +00:00

feat(vuln): automated CVE visibility for production (R-VULN-*, ADR-0027) #165

gitea-admin added 1 commit 2026-11-09 18:52:04 +00:00

docs(17): resolve two implementation escalations on registry state and SSO egress 28a1c0a2eb

credential-required now comes from a declared registry list, because LAN egress
is excluded and the scanner could never receive a refusal from the private
registry. The egress list now names the Gateway and identity provider, which
the SSO sidecar needs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

gitea-admin added 1 commit 2026-11-09 18:52:26 +00:00

Merge main into feature/vulnerability-visibility 46996d1f8a

Keeps both ADR index rows (0026 from #3 and 0027 from this branch).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/vulnerability-visibility:feature/vulnerability-visibility

git checkout feature/vulnerability-visibility

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s#4