Prowler

CIS Kubernetes Benchmark scanner for compliance posture reporting.

Quick Reference

PropertyValue
Namespaceprowler
Imageregistry.ops.eblu.me/blumeops/prowler (see argocd/manifests/prowler/kustomization.yaml for current tag)
ScheduleK8s CIS: Sunday 3am / Image: Saturday 3am / IaC: Saturday 2am
Reportssifaka:/volume1/reports/prowler/, prowler-images/, prowler-iac/ (NFS)
Manifestsargocd/manifests/prowler/

What it does

Runs Prowler 5 as two CronJobs:

  • K8s CIS scan (Sunday) — CIS Kubernetes Benchmark v1.11 checks across pod security, RBAC, apiserver, etcd, kubelet, controller-manager, and scheduler
  • Image scan (Saturday) — CVE, secret, and misconfiguration scanning of all blumeops/* container images in the registry via Trivy
  • IaC scan (Saturday) — static analysis of Dockerfiles, K8s manifests, and other IaC files in the repo via Trivy

Reports are written in HTML, CSV, and JSON-OCSF to the NFS share on sifaka.

See also