Erich Blume
696024306c
Add Trivy to the Prowler container for image and IaC scanning. New CronJob (Saturday 3am) scans all blumeops/* images in the registry for CVEs, embedded secrets, and Dockerfile misconfigs. Reports written to sifaka:/volume1/reports/prowler-images/. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: prowler-image-scan
|
|
namespace: prowler
|
|
spec:
|
|
schedule: "0 3 * * 6" # Saturday 3am
|
|
concurrencyPolicy: Forbid
|
|
jobTemplate:
|
|
spec:
|
|
ttlSecondsAfterFinished: 604800 # Auto-delete after 7 days
|
|
template:
|
|
spec:
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: prowler
|
|
image: registry.ops.eblu.me/blumeops/prowler:kustomized
|
|
args:
|
|
- image
|
|
- --registry
|
|
- registry.ops.eblu.me
|
|
- --image-filter
|
|
- blumeops/
|
|
- -z
|
|
- --output-formats
|
|
- html
|
|
- csv
|
|
- json-ocsf
|
|
- --output-directory
|
|
- /reports/prowler-images
|
|
volumeMounts:
|
|
- name: reports
|
|
mountPath: /reports
|
|
restartPolicy: OnFailure
|
|
volumes:
|
|
- name: reports
|
|
persistentVolumeClaim:
|
|
claimName: prowler-reports
|