2026-03-24 16:49:38 -07:00
|
|
|
---
|
2026-03-24 16:08:09 -07:00
|
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
|
|
|
kind: Kustomization
|
|
|
|
|
|
|
|
|
|
namespace: prowler
|
|
|
|
|
|
|
|
|
|
resources:
|
|
|
|
|
- serviceaccount.yaml
|
|
|
|
|
- rbac.yaml
|
|
|
|
|
- pv-nfs.yaml
|
|
|
|
|
- pvc.yaml
|
|
|
|
|
- cronjob.yaml
|
2026-03-24 16:43:08 -07:00
|
|
|
- cronjob-image-scan.yaml
|
2026-03-24 16:49:38 -07:00
|
|
|
- cronjob-iac-scan.yaml
|
2026-03-24 16:08:09 -07:00
|
|
|
|
Add Prowler mutelist and fix kube-state-metrics seccomp (#319)
## Summary
- Add mutelist files to suppress expected/accepted Prowler CIS findings from components we don't control
- Mutelist files stored in `mutelist/` directory, grouped by category, merged at runtime via initContainer
- Fix missing seccomp `RuntimeDefault` profile on kube-state-metrics deployment
### Mutelist categories
| File | Checks | Covers |
|------|--------|--------|
| `apiserver.yaml` | 12 | Minikube apiserver flags |
| `control-plane.yaml` | 3 | Scheduler, controller-manager, kubelet |
| `core-pod-security.yaml` | 7 | System pods, Tailscale operator, Grafana init, Prowler hostPID, forgejo-runner |
| `rbac.yaml` | 3 | Built-in K8s roles, ArgoCD, CNPG |
Muted findings appear as `status=MUTED` in reports (not hidden), preserving audit trail.
### Not muted (follow-up)
- Alloy, Immich pods missing seccomp — need separate investigation (Helm/operator-managed)
## Test plan
- [ ] `kubectl kustomize argocd/manifests/prowler/` renders cleanly
- [ ] Trigger manual scan: `kubectl --context=minikube-indri -n prowler create job prowler-mutelist-test --from=cronjob/prowler`
- [ ] Verify initContainer merges successfully (check pod logs)
- [ ] Verify muted findings show as `MUTED` in report
- [ ] Sync kube-state-metrics and verify pod starts with seccomp profile
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/319
2026-03-30 17:22:31 -07:00
|
|
|
configMapGenerator:
|
|
|
|
|
- name: prowler-mutelist
|
|
|
|
|
options:
|
|
|
|
|
disableNameSuffixHash: true
|
|
|
|
|
files:
|
|
|
|
|
- mutelist/apiserver.yaml
|
|
|
|
|
- mutelist/control-plane.yaml
|
|
|
|
|
- mutelist/core-pod-security.yaml
|
2026-04-14 13:00:44 -07:00
|
|
|
- mutelist/manual-node-checks.yaml
|
Add Prowler mutelist and fix kube-state-metrics seccomp (#319)
## Summary
- Add mutelist files to suppress expected/accepted Prowler CIS findings from components we don't control
- Mutelist files stored in `mutelist/` directory, grouped by category, merged at runtime via initContainer
- Fix missing seccomp `RuntimeDefault` profile on kube-state-metrics deployment
### Mutelist categories
| File | Checks | Covers |
|------|--------|--------|
| `apiserver.yaml` | 12 | Minikube apiserver flags |
| `control-plane.yaml` | 3 | Scheduler, controller-manager, kubelet |
| `core-pod-security.yaml` | 7 | System pods, Tailscale operator, Grafana init, Prowler hostPID, forgejo-runner |
| `rbac.yaml` | 3 | Built-in K8s roles, ArgoCD, CNPG |
Muted findings appear as `status=MUTED` in reports (not hidden), preserving audit trail.
### Not muted (follow-up)
- Alloy, Immich pods missing seccomp — need separate investigation (Helm/operator-managed)
## Test plan
- [ ] `kubectl kustomize argocd/manifests/prowler/` renders cleanly
- [ ] Trigger manual scan: `kubectl --context=minikube-indri -n prowler create job prowler-mutelist-test --from=cronjob/prowler`
- [ ] Verify initContainer merges successfully (check pod logs)
- [ ] Verify muted findings show as `MUTED` in report
- [ ] Sync kube-state-metrics and verify pod starts with seccomp profile
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/319
2026-03-30 17:22:31 -07:00
|
|
|
- mutelist/rbac.yaml
|
|
|
|
|
|
2026-03-24 16:08:09 -07:00
|
|
|
images:
|
|
|
|
|
- name: registry.ops.eblu.me/blumeops/prowler
|
2026-04-14 13:45:28 -07:00
|
|
|
newTag: v5.23.0-d05b503
|