eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/mise-tasks
History
Erich Blume d021b3534f
All checks were successful
Build Container / detect (push) Successful in 4s
Details
Build Container / build-dockerfile (prowler) (push) Successful in 10s
Details
Deploy Prowler CIS scanner (#310) 
## Summary
- Deploy Prowler 5 as a weekly CronJob on minikube-indri for CIS Kubernetes Benchmark v1.11 scanning
- Custom slim container build (strips PowerShell, Trivy, and non-K8s providers from upstream)
- Reports (HTML, CSV, JSON-OCSF) written to NFS share on sifaka at `/volume1/reports/prowler/`
- Read-only ClusterRole for pod, RBAC, and control plane inspection
- Host path mounts + hostPID for kubelet file permission checks

## Follow-ups
- Mirror prowler-cloud/prowler on forge for supply chain control
- Build and push container image, update kustomization.yaml newTag
- Consider adding k3s-ringtail scanning (core + RBAC checks only)

## Test plan
- [ ] Build container: `mise run container-release prowler v5.22.0`
- [ ] Update `argocd/manifests/prowler/kustomization.yaml` newTag to built image tag
- [ ] Sync ArgoCD: `argocd app sync apps && argocd app set prowler --revision deploy-prowler && argocd app sync prowler`
- [ ] Trigger manual job: `kubectl create job --from=cronjob/prowler prowler-manual -n prowler --context=minikube-indri`
- [ ] Verify reports appear on sifaka NFS share
- [ ] `mise run services-check`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #310
2026-03-24 16:08:09 -07:00
..
ai-docs Add ai-sources task, update ai-docs to include all docs 2026-03-15 18:37:50 -07:00
ai-sources Exclude docs from ai-sources, mention ai-sources in CLAUDE.md 2026-03-15 18:40:35 -07:00
blumeops-tasks Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
branch-cleanup Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
changelog-check Add pre-commit check for changelog fragment placement 2026-03-03 10:49:01 -08:00
container-build-and-release Deploy Prowler CIS scanner (#310) 2026-03-24 16:08:09 -07:00
container-list Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
container-version-check Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
dns-preview Add plan and reference card for UniFi Express 7 Pulumi stack (#145) 2026-02-10 15:36:13 -08:00
dns-up Add plan and reference card for UniFi Express 7 Pulumi stack (#145) 2026-02-10 15:36:13 -08:00
docs-check-frontmatter Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
docs-check-links Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
docs-mikado Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
docs-preview Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
docs-review Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
docs-review-stale Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
docs-review-tags Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
ensure-k3s-ringtail-kubectl-config Add k3s, 1Password Connect, and systemd nix-container-builder to ringtail (#209) 2026-02-18 21:15:30 -08:00
ensure-minikube-indri-kubectl-config P5.1: Migrate minikube from podman to QEMU2 driver (#38) 2026-01-21 16:03:37 -08:00
fly-deploy Add Fly.io public reverse proxy for docs.eblu.me (#120) 2026-02-08 02:36:19 -08:00
fly-setup Expose Forgejo publicly at forge.eblu.me (#278) 2026-03-03 08:40:41 -08:00
fly-shutoff Add Fly.io public reverse proxy for docs.eblu.me (#120) 2026-02-08 02:36:19 -08:00
frigate-export-model Fix dagger call hanging in mise tasks on interactive terminals (#256) 2026-02-23 14:15:58 -08:00
mikado-branch-invariant-check Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
mirror-create Expose Forgejo publicly at forge.eblu.me (#278) 2026-03-03 08:40:41 -08:00
mirror-update-pats Fix mirror-update-pats corrupting all GitHub mirror URLs 2026-03-03 11:46:41 -08:00
op-backup Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
pr-comments Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
provision-indri Set MISE_TASK_OUTPUT=interleave in provision-indri 2026-01-14 14:15:11 -08:00
provision-ringtail Fix dagger call hanging in mise tasks on interactive terminals (#256) 2026-02-23 14:15:58 -08:00
provision-sifaka Operations and observability for sifaka NAS (#135) 2026-02-09 17:44:05 -08:00
runner-logs Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
service-review Update tooling dependencies (March 2026) (#307) 2026-03-24 08:11:46 -07:00
services-check Decommission JobSync service (#308) 2026-03-24 08:44:23 -07:00
tailnet-preview Add plan and reference card for UniFi Express 7 Pulumi stack (#145) 2026-02-10 15:36:13 -08:00
tailnet-up Add plan and reference card for UniFi Express 7 Pulumi stack (#145) 2026-02-10 15:36:13 -08:00
validate-workflows Fix dagger call hanging in mise tasks on interactive terminals (#256) 2026-02-23 14:15:58 -08:00