Erich Blume
d021b3534f
## Summary - Deploy Prowler 5 as a weekly CronJob on minikube-indri for CIS Kubernetes Benchmark v1.11 scanning - Custom slim container build (strips PowerShell, Trivy, and non-K8s providers from upstream) - Reports (HTML, CSV, JSON-OCSF) written to NFS share on sifaka at `/volume1/reports/prowler/` - Read-only ClusterRole for pod, RBAC, and control plane inspection - Host path mounts + hostPID for kubelet file permission checks ## Follow-ups - Mirror prowler-cloud/prowler on forge for supply chain control - Build and push container image, update kustomization.yaml newTag - Consider adding k3s-ringtail scanning (core + RBAC checks only) ## Test plan - [ ] Build container: `mise run container-release prowler v5.22.0` - [ ] Update `argocd/manifests/prowler/kustomization.yaml` newTag to built image tag - [ ] Sync ArgoCD: `argocd app sync apps && argocd app set prowler --revision deploy-prowler && argocd app sync prowler` - [ ] Trigger manual job: `kubectl create job --from=cronjob/prowler prowler-manual -n prowler --context=minikube-indri` - [ ] Verify reports appear on sifaka NFS share - [ ] `mise run services-check` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #310
2.6 KiB
2.6 KiB
| title | modified | tags | ||
|---|---|---|---|---|
| Apps | 2026-03-04 |
|
ArgoCD Applications
Registry of all applications deployed via argocd.
Application Registry
| App | Namespace | Path/Source | Service |
|---|---|---|---|
apps |
argocd | argocd/apps/ |
App-of-apps root |
argocd |
argocd | argocd/manifests/argocd/ |
argocd |
tailscale-operator |
tailscale | argocd/manifests/tailscale-operator/ |
tailscale-operator |
1password-connect |
1password | argocd/manifests/1password-connect/ |
1password |
external-secrets |
external-secrets | Helm chart | 1password |
external-secrets-config |
external-secrets | argocd/manifests/external-secrets-config/ |
1password |
cloudnative-pg |
cnpg-system | mirrors/cloudnative-pg release manifest |
PostgreSQL operator |
blumeops-pg |
databases | argocd/manifests/databases/ |
postgresql |
prometheus |
monitoring | argocd/manifests/prometheus/ |
prometheus |
loki |
monitoring | argocd/manifests/loki/ |
loki |
grafana |
monitoring | Helm chart (forge mirror) | grafana |
grafana-config |
monitoring | argocd/manifests/grafana-config/ |
grafana |
immich |
immich | Helm chart | immich |
tempo |
monitoring | argocd/manifests/tempo/ |
tempo |
alloy-k8s |
alloy | argocd/manifests/alloy-k8s/ |
[[alloy |
alloy-tracing-ringtail |
alloy | argocd/manifests/alloy-tracing-ringtail/ |
[[alloy |
kube-state-metrics |
monitoring | argocd/manifests/kube-state-metrics/ |
K8s metrics |
miniflux |
miniflux | argocd/manifests/miniflux/ |
miniflux |
kiwix |
kiwix | argocd/manifests/kiwix/ |
kiwix |
torrent |
torrent | argocd/manifests/torrent/ |
transmission |
navidrome |
navidrome | argocd/manifests/navidrome/ |
navidrome |
teslamate |
teslamate | argocd/manifests/teslamate/ |
teslamate |
cv |
cv | argocd/manifests/cv/ |
cv |
forgejo-runner |
forgejo-runner | argocd/manifests/forgejo-runner/ |
forgejo CI |
ollama |
ollama | argocd/manifests/ollama/ |
ollama |
mealie |
mealie | argocd/manifests/mealie/ |
mealie |
prowler |
prowler | argocd/manifests/prowler/ |
prowler |
Sync Policies
| Application | Policy | Rationale |
|---|---|---|
apps |
Automated | Picks up new Application manifests |
| All others | Manual | Explicit control over deployments |