Change Prowler (k8s, iac, image) and Kingfisher CronJobs to write
reports under YYYY-MM-DD subdirectories instead of a flat directory.
Prevents clutter as weekly scans accumulate.
Before: /reports/prowler/prowler-output-In-Cluster-20260329030006.html
After: /reports/prowler/2026-03-29/prowler-output-In-Cluster-20260329030006.html
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Introduce compensating-controls.yaml to track named controls that
justify suppressed security findings. Each control has a description,
verification notes, and last-reviewed date.
Update all Prowler mutelist descriptions to reference controls via
"CC: <id>" prefix instead of restating findings. Nine controls cover:
single-user-cluster, tailscale-network-isolation, local-registry,
sso-gated-admin-tools, operator-managed-pods, ephemeral-privileged-jobs,
trusted-ci-only, init-container-isolation, observability-stack-audit.
Add mise task (review-compensating-controls) that surfaces the most
stale control with all codebase references, and how-to doc
([[review-compensating-controls]]) explaining the review process.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
