Deploy Prowler CIS scanner #310

Merged

eblume merged 7 commits from deploy-prowler into main

2026-03-24 16:08:10 -07:00

eblume commented

2026-03-24 15:05:04 -07:00

Owner

Summary

Deploy Prowler 5 as a weekly CronJob on minikube-indri for CIS Kubernetes Benchmark v1.11 scanning
Custom slim container build (strips PowerShell, Trivy, and non-K8s providers from upstream)
Reports (HTML, CSV, JSON-OCSF) written to NFS share on sifaka at /volume1/reports/prowler/
Read-only ClusterRole for pod, RBAC, and control plane inspection
Host path mounts + hostPID for kubelet file permission checks

Follow-ups

Mirror prowler-cloud/prowler on forge for supply chain control
Build and push container image, update kustomization.yaml newTag
Consider adding k3s-ringtail scanning (core + RBAC checks only)

Test plan

Build container: mise run container-release prowler v5.22.0
Update argocd/manifests/prowler/kustomization.yaml newTag to built image tag
Sync ArgoCD: argocd app sync apps && argocd app set prowler --revision deploy-prowler && argocd app sync prowler
Trigger manual job: kubectl create job --from=cronjob/prowler prowler-manual -n prowler --context=minikube-indri
Verify reports appear on sifaka NFS share
mise run services-check

🤖 Generated with Claude Code

## Summary - Deploy Prowler 5 as a weekly CronJob on minikube-indri for CIS Kubernetes Benchmark v1.11 scanning - Custom slim container build (strips PowerShell, Trivy, and non-K8s providers from upstream) - Reports (HTML, CSV, JSON-OCSF) written to NFS share on sifaka at `/volume1/reports/prowler/` - Read-only ClusterRole for pod, RBAC, and control plane inspection - Host path mounts + hostPID for kubelet file permission checks ## Follow-ups - Mirror prowler-cloud/prowler on forge for supply chain control - Build and push container image, update kustomization.yaml newTag - Consider adding k3s-ringtail scanning (core + RBAC checks only) ## Test plan - [ ] Build container: `mise run container-release prowler v5.22.0` - [ ] Update `argocd/manifests/prowler/kustomization.yaml` newTag to built image tag - [ ] Sync ArgoCD: `argocd app sync apps && argocd app set prowler --revision deploy-prowler && argocd app sync prowler` - [ ] Trigger manual job: `kubectl create job --from=cronjob/prowler prowler-manual -n prowler --context=minikube-indri` - [ ] Verify reports appear on sifaka NFS share - [ ] `mise run services-check` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

eblume added 1 commit

2026-03-24 15:05:04 -07:00

Deploy Prowler CIS scanner as weekly CronJob on minikube-indri a97391177a

Custom slim container (no PowerShell/Trivy), NFS-backed reports
on sifaka:/volume1/reports/prowler/, ClusterRole with read-only
RBAC for Kubernetes CIS Benchmark v1.11 checks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-24 15:22:32 -07:00

Use forge mirror for Prowler container build 870be4e6a8

Clone from forge.ops.eblu.me/mirrors/prowler instead of GitHub
directly. Mirror already exists. Fix OCI source label to use
canonical forge.eblu.me URL per repo convention. Add prowler
entry to service-versions.yaml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-24 15:32:51 -07:00

Fix container-build-and-release to use single unified workflow ed9478f493

The build-container-nix.yaml workflow was merged into
build-container.yaml. Remove the second dispatch that now 404s.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-24 15:37:50 -07:00

Update prowler image tag to branch build 6f0ec0e160

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-24 15:45:17 -07:00

Fix NFS mount path for shared reports share 9d0001355c

Mount /volume1/reports (share root) not /volume1/reports/prowler.
Prowler writes to /reports/prowler/ subdirectory within the mount.
This allows other services to share the same NFS share.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-24 15:50:48 -07:00

Fix prowler output-formats args (separate values, not comma-separated) 070a684946

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eblume added 1 commit

2026-03-24 16:05:52 -07:00

Add security reference card and compliance report how-to 9053ce5955

Split report-reading guidance out of deploy-prowler into its own
how-to (read-compliance-reports). Add security & compliance
reference card (reference/operations/security) following the
pattern of the observability card.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>