Deploy Prowler CIS Scanner
Prowler runs a weekly CIS Kubernetes Benchmark scan against the ringtail k3s cluster (the prowler-ringtail app — prowler scans the cluster it runs in) and writes HTML/CSV/JSON reports to the NFS share on sifaka.
Why only the K8s CIS scan
Prowler originally ran three CronJobs: K8s CIS, container-image CVE scanning, and IaC scanning. The image and IaC scans were retired in 2026-06.
Both were pure toil with no realized value:
- Image scan produced ~20,000 unmuted findings per run and growing, none ever triaged or muted. They were overwhelmingly CVEs in upstream base images we don’t control and can’t patch, and the job re-scanned every historical tag still in the registry, multiplying the count.
- IaC scan produced ~650 Trivy KSV findings (
runAsNonRoot,readOnlyRootFilesystem, drop-capabilities, …) against our own manifests — real but systemic, homelab-acceptable, and likewise never muted, so the weekly review re-surfaced all of them indefinitely.
The K8s CIS scan, by contrast, is fully mutelisted and runs clean (0 unmuted findings week over week), so it stays. The guiding principle matches ai-scraper-mitigation: don’t keep generating a firehose of output that has no audience. If image-CVE signal is wanted later, the right shape is critical-severity-only, currently-deployed-tags-only, alert-on-new — a rebuild, not a revival (tracked as the “Trivy for image/IaC scanning” task).
The scan originally targeted minikube-indri; with retire-minikube (2026-06) prowler moved to ringtail and now scans k3s, where only ~22 of 70 checks produce results (no static control-plane pods). The mutelist still carries minikube-shaped entries — inert on k3s, pending a rework pass.
What it checks
Kubernetes CIS benchmarks (Sunday 3am)
Prowler’s Kubernetes provider runs ~70 checks from the CIS Kubernetes Benchmark v1.11, grouped into:
| Category | Checks | How it works |
|---|---|---|
| Core (pod security) | 13 | Queries K8s API for privileged containers, hostPID/hostNetwork, capabilities, secrets in env vars, seccomp |
| RBAC | 9 | Queries RBAC API for overprivileged roles, wildcard access, cluster-admin bindings |
| Apiserver | 29 | Inspects kube-apiserver pod args in kube-system (TLS, auth, audit, admission plugins) |
| Etcd | 7 | Inspects etcd pod args (TLS, cert auth) |
| Controller Manager | 7 | Inspects kube-controller-manager pod args |
| Kubelet | 16 | Reads kubelet-config ConfigMap + node file permissions (file checks need hostPID) |
| Scheduler | 2 | Inspects kube-scheduler pod args |
Minikube relevance (historical): most checks worked because minikube ran the control plane as static pods. Kubelet file permission checks return MANUAL unless Prowler runs on the node (we mount host paths to enable this).
k3s note: k3s embeds the control plane in a single binary — no static pods exist. Only core + RBAC checks (~22 of 70) produce results. Consider kube-bench for k3s control plane checks.
Reports
Reports are written to sifaka:/volume1/reports/prowler/ with timestamped filenames. See read-compliance-reports for how to access and interpret them.
Running an ad-hoc scan
kubectl create job --from=cronjob/prowler prowler-manual -n prowler --context=k3s-ringtailWatch progress:
kubectl logs -f job/prowler-manual -n prowler --context=k3s-ringtailContainer
Nix build at containers/prowler/default.nix — wraps nixpkgs’ prowler
(pinned to 5.12.3; nixpkgs lags upstream, re-bump via service-review when it
catches up) plus python3/pyyaml for the mutelist-merge initContainer. The
earlier Dockerfile build’s bundled Trivy and non-Kubernetes providers were
dropped. See build-container-image for the build/release process.
Source is mirrored at forge.ops.eblu.me/mirrors/prowler.
See also
- security — security & compliance posture overview
- read-compliance-reports — how to access and interpret scan reports
- deploy-k8s-service — general K8s deployment how-to
- build-container-image — container build pipeline