eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/argocd/manifests
History
Erich Blume a76e471d54 Add Prowler mutelist and fix kube-state-metrics seccomp (#319) 
## Summary

- Add mutelist files to suppress expected/accepted Prowler CIS findings from components we don't control
- Mutelist files stored in `mutelist/` directory, grouped by category, merged at runtime via initContainer
- Fix missing seccomp `RuntimeDefault` profile on kube-state-metrics deployment

### Mutelist categories

| File | Checks | Covers |
|------|--------|--------|
| `apiserver.yaml` | 12 | Minikube apiserver flags |
| `control-plane.yaml` | 3 | Scheduler, controller-manager, kubelet |
| `core-pod-security.yaml` | 7 | System pods, Tailscale operator, Grafana init, Prowler hostPID, forgejo-runner |
| `rbac.yaml` | 3 | Built-in K8s roles, ArgoCD, CNPG |

Muted findings appear as `status=MUTED` in reports (not hidden), preserving audit trail.

### Not muted (follow-up)

- Alloy, Immich pods missing seccomp — need separate investigation (Helm/operator-managed)

## Test plan

- [ ] `kubectl kustomize argocd/manifests/prowler/` renders cleanly
- [ ] Trigger manual scan: `kubectl --context=minikube-indri -n prowler create job prowler-mutelist-test --from=cronjob/prowler`
- [ ] Verify initContainer merges successfully (check pod logs)
- [ ] Verify muted findings show as `MUTED` in report
- [ ] Sync kube-state-metrics and verify pod starts with seccomp profile

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #319
2026-03-30 17:22:31 -07:00
..
1password-connect Fix 1Password Connect credentials for chart 2.3.0 2026-02-13 17:30:45 -08:00
alloy-k8s Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
alloy-ringtail Deploy Tor Snowflake proxy on ringtail (#311) 2026-03-24 20:51:40 -07:00
alloy-tracing-ringtail Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
argocd Add ExternalSecret default fields to prevent ArgoCD drift 2026-03-05 09:11:23 -08:00
authentik Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
cloudnative-pg Port CloudNative-PG off Helm to direct release manifest (#268) 2026-02-25 17:37:53 -08:00
cv Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
databases Add borgmatic backups for authentik and immich databases (#314) 2026-03-27 16:59:58 -07:00
devpi Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
docs Update docs release to v1.15.1 2026-03-28 09:15:21 -07:00
external-secrets Upgrade External Secrets Operator v2.2.0 + migrate Helm to kustomize (#312) 2026-03-25 15:56:41 -07:00
forgejo-runner Upgrade forgejo-runner 12.7.0 → 12.7.3, add service card 2026-03-30 16:31:06 -07:00
frigate Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
grafana Reduce PodNotReady alert lookback from 5m to 60s 2026-03-26 19:48:37 -07:00
grafana-config Add offsite backup for immich photo library to BorgBase (#315) 2026-03-27 19:43:05 -07:00
homepage Deploy Homepage v1.11.0-e375859 2026-03-26 10:25:07 -07:00
immich Fix Immich resource limits and probe timeouts 2026-03-27 22:36:32 -07:00
kingfisher Fix Kingfisher CronJob exit code handling 2026-03-30 07:16:02 -07:00
kiwix Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
kube-state-metrics Add Prowler mutelist and fix kube-state-metrics seccomp (#319) 2026-03-30 17:22:31 -07:00
kube-state-metrics-ringtail Add :kustomized sentinel tag to manifest images, review devpi 2026-03-06 08:15:06 -08:00
loki Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
mealie Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
miniflux Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
navidrome Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
ntfy Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
nvidia-device-plugin Upgrade nvidia-device-plugin v0.18.2 → v0.19.0 and add reference card 2026-03-27 07:19:24 -07:00
ollama Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
prometheus Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
prowler Add Prowler mutelist and fix kube-state-metrics seccomp (#319) 2026-03-30 17:22:31 -07:00
tailscale-operator Expose Forgejo publicly at forge.eblu.me (#278) 2026-03-03 08:40:41 -08:00
tailscale-operator-base Revert Tailscale operator to v1.94.2 — images not yet published 2026-03-22 19:41:40 -07:00
tailscale-operator-ringtail Deploy Tailscale operator on ringtail k3s cluster (#215) 2026-02-19 09:33:05 -08:00
tempo Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
teslamate Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
torrent Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
unpoller Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00