99e01f97fc
Some checks failed
Dev CI / Security gate (push) Successful in 31s
Dev CI / Backend — Lint (push) Successful in 1m8s
Dev CI / Frontend — Lint & Type-check (push) Successful in 1m14s
Dev CI / Backend — Unit Tests (push) Successful in 1m10s
Dev CI / Frontend — Unit Tests (push) Successful in 46s
Dev CI / Notify Failure (push) Has been skipped
CD Preprod / Security gate (push) Successful in 29s
CD Preprod / Backend — Lint (push) Successful in 1m7s
CD Preprod / Frontend — Lint & Type-check (push) Successful in 1m13s
CD Preprod / Backend — Unit Tests (push) Successful in 1m6s
CD Preprod / Frontend — Unit Tests (push) Successful in 44s
CD Preprod / Backend — Integration Tests (push) Failing after 37s
CD Preprod / Build Log Exporter (push) Has been skipped
CD Preprod / Image security (${{ matrix.service }}, ${{ matrix.arch }}) (amd64, backend) (push) Has been skipped
CD Preprod / Build Backend (push) Has been skipped
CD Preprod / Build Frontend (push) Has been skipped
CD Preprod / Image security (${{ matrix.service }}, ${{ matrix.arch }}) (amd64, frontend) (push) Has been skipped
CD Preprod / Image security (${{ matrix.service }}, ${{ matrix.arch }}) (amd64, log-exporter) (push) Has been skipped
CD Preprod / Image security (${{ matrix.service }}, ${{ matrix.arch }}) (arm64, backend) (push) Has been skipped
CD Preprod / Image security (${{ matrix.service }}, ${{ matrix.arch }}) (arm64, frontend) (push) Has been skipped
CD Preprod / Image security (${{ matrix.service }}, ${{ matrix.arch }}) (arm64, log-exporter) (push) Has been skipped
CD Preprod / Deploy to Preprod (push) Has been skipped
CD Preprod / Notify Success (push) Has been skipped
CD Preprod / Notify Failure (push) Has been skipped
23 lines
1.2 KiB
YAML
23 lines
1.2 KiB
YAML
# Approved monitoring exceptions, reviewed 2026-09-24. No dependency/secret exclusions.
|
|
misconfigurations:
|
|
- id: AVD-KSV-0047
|
|
paths: [infra/prod/k8s/monitoring/03-prometheus.yaml]
|
|
expired_at: 2026-10-24
|
|
statement: Prometheus scrapes kubelet cAdvisor through the API server node proxy; retain until direct authenticated kubelet scraping is validated.
|
|
- id: AVD-KSV-0009
|
|
paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
|
|
expired_at: 2026-10-24
|
|
statement: Node exporter observes host network metrics; isolated to the monitoring DaemonSet.
|
|
- id: AVD-KSV-0010
|
|
paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
|
|
expired_at: 2026-10-24
|
|
statement: Node exporter observes host processes; runs as non-root with all capabilities dropped.
|
|
- id: AVD-KSV-0024
|
|
paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
|
|
expired_at: 2026-10-24
|
|
statement: Existing host-network exporter listens on port 9101; access remains constrained by infrastructure firewall rules.
|
|
- id: AVD-KSV-0121
|
|
paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
|
|
expired_at: 2026-10-24
|
|
statement: Host proc/sys/root mounts provide disk and system metrics and are read-only; required for disk-full alerts.
|