docs: retire Prowler image + IaC scans, keep K8s CIS only
Document the decision to retire the container-image CVE scan and the IaC scan, which generated tens of thousands of un-actioned, un-muted findings weekly with no realized value. The K8s CIS scan (fully mutelisted, runs clean) is retained. Rationale captured in deploy-prowler. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
e592ecfca4
commit
3166aa88dd
4 changed files with 33 additions and 47 deletions
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Deploy Prowler CIS Scanner
|
||||
modified: 2026-03-24
|
||||
modified: 2026-06-08
|
||||
last-reviewed: 2026-03-24
|
||||
tags:
|
||||
- how-to
|
||||
|
|
@ -11,7 +11,20 @@ tags:
|
|||
|
||||
# Deploy Prowler CIS Scanner
|
||||
|
||||
Prowler runs weekly CIS Kubernetes Benchmark scans against minikube-indri and writes HTML/CSV/JSON reports to the NFS share on sifaka.
|
||||
Prowler runs a weekly CIS Kubernetes Benchmark scan against minikube-indri and writes HTML/CSV/JSON reports to the NFS share on sifaka.
|
||||
|
||||
## Why only the K8s CIS scan
|
||||
|
||||
Prowler originally ran three CronJobs: K8s CIS, container-image CVE scanning, and IaC scanning. The image and IaC scans were **retired in 2026-06**.
|
||||
|
||||
Both were pure toil with no realized value:
|
||||
|
||||
- **Image scan** produced ~20,000 unmuted findings per run and growing, none ever triaged or muted. They were overwhelmingly CVEs in *upstream* base images we don't control and can't patch, and the job re-scanned every historical tag still in the registry, multiplying the count.
|
||||
- **IaC scan** produced ~650 Trivy KSV findings (`runAsNonRoot`, `readOnlyRootFilesystem`, drop-capabilities, …) against our own manifests — real but systemic, homelab-acceptable, and likewise never muted, so the weekly review re-surfaced all of them indefinitely.
|
||||
|
||||
The K8s CIS scan, by contrast, is fully mutelisted and runs clean (0 unmuted findings week over week), so it stays. The guiding principle matches [[ai-scraper-mitigation]]: don't keep generating a firehose of output that has no audience. If image-CVE signal is wanted later, the right shape is critical-severity-only, currently-deployed-tags-only, alert-on-new — a rebuild, not a revival (tracked as the "Trivy for image/IaC scanning" task).
|
||||
|
||||
Note that the K8s CIS scan itself is tied to minikube-indri, which is slated for retirement; on k3s only ~22 of 70 checks produce results (no static pods). Re-pointing a lean posture check at ringtail is tracked separately ("prowler scan against ringtail").
|
||||
|
||||
## What it checks
|
||||
|
||||
|
|
@ -33,38 +46,6 @@ Prowler's Kubernetes provider runs ~70 checks from the CIS Kubernetes Benchmark
|
|||
|
||||
**k3s note:** k3s embeds the control plane in a single binary — no static pods exist. Only core + RBAC checks (~22 of 70) produce results. Consider `kube-bench` for k3s control plane checks.
|
||||
|
||||
### Image vulnerability scanning (Saturday 3am)
|
||||
|
||||
Prowler's image provider scans all `blumeops/*` container images in `registry.ops.eblu.me` for:
|
||||
|
||||
- **CVEs** — known vulnerabilities from NVD, Alpine SecDB, Debian Security Tracker, and other sources
|
||||
- **Embedded secrets** — credentials or API keys baked into image layers
|
||||
- **Misconfigurations** — Dockerfile best practices (running as root, missing HEALTHCHECK, etc.)
|
||||
|
||||
Uses Trivy under the hood. Reports are written to `sifaka:/volume1/reports/prowler-images/`.
|
||||
|
||||
To run an ad-hoc image scan:
|
||||
|
||||
```fish
|
||||
kubectl create job --from=cronjob/prowler-image-scan prowler-image-manual -n prowler --context=minikube-indri
|
||||
```
|
||||
|
||||
### IaC scanning (Saturday 2am)
|
||||
|
||||
Prowler's IaC provider scans the blumeops repository (cloned at scan time) for misconfigurations in:
|
||||
|
||||
- **Dockerfiles** — running as root, using `latest` tags, missing `HEALTHCHECK`
|
||||
- **Kubernetes manifests** — missing resource limits, privileged containers, insecure settings
|
||||
- **Other IaC files** — Terraform, CloudFormation, etc. if present
|
||||
|
||||
Uses Trivy under the hood. Reports are written to `sifaka:/volume1/reports/prowler-iac/`.
|
||||
|
||||
To run an ad-hoc IaC scan:
|
||||
|
||||
```fish
|
||||
kubectl create job --from=cronjob/prowler-iac-scan prowler-iac-manual -n prowler --context=minikube-indri
|
||||
```
|
||||
|
||||
## Reports
|
||||
|
||||
Reports are written to `sifaka:/volume1/reports/prowler/` with timestamped filenames. See [[read-compliance-reports]] for how to access and interpret them.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Read Compliance Reports
|
||||
modified: 2026-04-06
|
||||
modified: 2026-06-08
|
||||
last-reviewed: 2026-04-06
|
||||
tags:
|
||||
- how-to
|
||||
|
|
@ -27,8 +27,13 @@ Reports are stored on sifaka at `/volume1/reports/`. Each scanner writes to its
|
|||
| Scanner | Path | Schedule |
|
||||
|---------|------|----------|
|
||||
| [[prowler]] K8s CIS | `sifaka:/volume1/reports/prowler/` | Weekly (Sunday 3am) |
|
||||
| [[prowler]] Image | `sifaka:/volume1/reports/prowler-images/` | Weekly (Saturday 3am) |
|
||||
| [[prowler]] IaC | `sifaka:/volume1/reports/prowler-iac/` | Weekly (Saturday 2am) |
|
||||
|
||||
> **Retired (2026-06):** the Prowler **image** (`prowler-images/`) and **IaC**
|
||||
> (`prowler-iac/`) scans were retired. They produced tens of thousands of
|
||||
> un-actioned, un-muted findings every week — mostly unpatchable upstream-image
|
||||
> CVEs and systemic pod-security KSV warnings — and nobody triaged them. See
|
||||
> [[deploy-prowler#Why only the K8s CIS scan]] for the rationale. Their stale
|
||||
> report directories may linger on sifaka until manually removed.
|
||||
|
||||
Copy reports to your local machine (remember `scp -O` for sifaka):
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Security & Compliance
|
||||
modified: 2026-03-24
|
||||
modified: 2026-06-08
|
||||
last-reviewed: 2026-03-24
|
||||
tags:
|
||||
- operations
|
||||
|
|
@ -21,7 +21,7 @@ Security posture and compliance scanning for BlumeOps infrastructure.
|
|||
|
||||
## Scanning tools
|
||||
|
||||
- [[prowler]] — CIS Kubernetes Benchmark scanner (weekly CronJob)
|
||||
- [[prowler]] — CIS Kubernetes Benchmark scanner (weekly CronJob). The container-image CVE scan and IaC scan were retired in 2026-06 (un-actioned noise — see [[deploy-prowler#Why only the K8s CIS scan]]); only the K8s CIS scan remains.
|
||||
- [[deploy-prowler]] — deployment and ad-hoc scan how-to
|
||||
- [[read-compliance-reports]] — accessing and interpreting reports
|
||||
- [[kingfisher]] — Secret detection and live validation for Forgejo repos (weekly CronJob + prek hook)
|
||||
|
|
@ -52,5 +52,5 @@ Suppressed findings are kept in Prowler mutelist YAML under `argocd/manifests/pr
|
|||
|
||||
- No SOC 2 compliance mapping for Kubernetes (Prowler only maps SOC 2 for AWS/Azure/GCP)
|
||||
- k3s control plane checks produce no results (embedded binary, no static pods) — consider kube-bench
|
||||
- Container image scanning covers `blumeops/*` images only — upstream images (ollama, immich, etc.) are not scanned
|
||||
- IaC scanning covers the blumeops repo only — no scanning of third-party Helm charts or vendored manifests
|
||||
- No container-image CVE scanning (the Prowler image scan was retired 2026-06 as un-actioned noise). If reintroduced, scope it to critical-severity, currently-deployed tags, alert-on-new
|
||||
- No automated IaC misconfiguration scanning (the Prowler IaC scan was retired 2026-06). Manifest pod-security hardening is now an accept-and-document decision rather than a weekly report
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
title: Prowler
|
||||
modified: 2026-03-24
|
||||
modified: 2026-06-08
|
||||
last-reviewed: 2026-03-24
|
||||
tags:
|
||||
- service
|
||||
|
|
@ -17,20 +17,20 @@ CIS Kubernetes Benchmark scanner for compliance posture reporting.
|
|||
|----------|-------|
|
||||
| **Namespace** | `prowler` |
|
||||
| **Image** | `registry.ops.eblu.me/blumeops/prowler` (see `argocd/manifests/prowler/kustomization.yaml` for current tag) |
|
||||
| **Schedule** | K8s CIS: Sunday 3am / Image: Saturday 3am / IaC: Saturday 2am |
|
||||
| **Reports** | `sifaka:/volume1/reports/prowler/`, `prowler-images/`, `prowler-iac/` (NFS) |
|
||||
| **Schedule** | K8s CIS: Sunday 3am |
|
||||
| **Reports** | `sifaka:/volume1/reports/prowler/` (NFS) |
|
||||
| **Manifests** | `argocd/manifests/prowler/` |
|
||||
|
||||
## What it does
|
||||
|
||||
Runs Prowler 5 as two CronJobs:
|
||||
Runs Prowler 5 as a single CronJob:
|
||||
|
||||
- **K8s CIS scan** (Sunday) — CIS Kubernetes Benchmark v1.11 checks across pod security, RBAC, apiserver, etcd, kubelet, controller-manager, and scheduler
|
||||
- **Image scan** (Saturday) — CVE, secret, and misconfiguration scanning of all `blumeops/*` container images in the registry via Trivy
|
||||
- **IaC scan** (Saturday) — static analysis of Dockerfiles, K8s manifests, and other IaC files in the repo via Trivy
|
||||
|
||||
Reports are written in HTML, CSV, and JSON-OCSF to the NFS share on sifaka.
|
||||
|
||||
The **image** and **IaC** scans (formerly Saturday CronJobs) were retired in 2026-06 — they generated tens of thousands of un-actioned findings weekly. See [[deploy-prowler#Why only the K8s CIS scan]].
|
||||
|
||||
## See also
|
||||
|
||||
- [[security]] — security & compliance posture overview
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue