v0.8.0

What's changed in v0.8.0

• chore(deps): update unbounded-tech/workflow-vnext-tag action to v1.21.3 (#2) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

• feat(deps): update crossplane-contrib/function-auto-ready docker tag to v0.7.0 (#7) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.7.0...v0.8.0

v0.7.0

What's changed in v0.7.0

• feat: add security resource defaults and nodepool (#6) (by @patrickleet)

• chore(deps): update unbounded-tech/workflow-simple-release action to v2.1.3 (#1) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.6.0...v0.7.0

v0.6.0

What's changed in v0.6.0

• fix: bump falco memory limit from 1Gi to 2Gi (by @patrickleet)

  1Gi default OOMKills repeatedly under modest load on pat-local — the
  userspace rule engine plus Lua plugin scratch space outgrows it within
  hours. 2Gi gives headroom; raise further via spec.falco.values.resources
  for larger clusters.

• feat: resource defaults for trivy-operator (by @patrickleet)

  P95 observed at 439Mi on pat-local while running BestEffort. Bump to
  512Mi request==limit (memory protection) with 100m CPU request, no CPU
  limit.

  Implements [[tasks/cluster-wide-resource-right-sizing-p95-observation]] tier-1 #3

• : (by @patrickleet)

• feat: Burstable resource defaults for falcosidekick + k8s-metacollector (by @patrickleet)

  Both falco subchart components shipped BestEffort by default. Sized for
  small-to-medium clusters; override via spec.falco.values for larger
  event volume.

  Verified on pat-local:

  • falco-falcosidekick (2 replicas) → Burstable, mem-lim=128Mi
  • falco-k8s-metacollector → Burstable, mem-lim=256Mi

  Implements [[tasks/cluster-wide-resource-right-sizing-p95-observation]] tier-1 #8

• feat: Burstable resource defaults for trivy-operator (by @patrickleet)

  Chart 0.30.0 (and 0.32.x) reads top-level resources: for the operator
  Deployment — operator.resources is silently ignored (which is why the
  earlier attempt in c61161e was a no-op and got reverted in f0c997f).

  P95 observed at 439Mi on pat-local while running BestEffort. Sized to
  100m/512Mi req, 512Mi mem limit. Burstable: stateless operator caching
  scan reports; restart-cheap.

  Verified on pat-local: trivy-operator-dc46cdd6c-95wbl rolled to
  Burstable, mem-lim=512Mi after helm upgrade.

  Implements [[tasks/cluster-wide-resource-right-sizing-p95-observation]] tier-1 #3

• fix: bump trivy-operator memory to 1Gi and add scanner resources (by @patrickleet)

  trivy-operator P95 observed at 638Mi on pat-local — the initial 512Mi
  limit OOMKilled under scan churn. Bumped to 1Gi.

  Also set trivy.resources for the scan job containers: chart default
  100m/100M req, 500m/500M limit OOMKilled on real-world images (anything
  larger than ~300MB unpacked). Bumped to 256Mi req, 1Gi limit to handle
  typical platform images.

  Verified on pat-local: trivy-operator-8cb478d7-rhmpl → Burstable,
  mem-lim=1Gi; scan-vulnerabilityreport pods initializing without OOM.

• feat(deps): update crossplane-contrib/function-auto-ready docker tag to v0.6.5 (#4) (by @renovate[bot])

  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

See full diff: v0.5.0...v0.6.0

v0.5.0

What's changed in v0.5.0

• feat: GrafanaDashboard CRs + PrometheusRule with 6 security alerts (by @patrickleet)

  Dashboards (composed when spec.observe.enabled):

  • security-trivy — Trivy Operator overview (grafana.com/d/17813)
  • security-falco — Falco metrics + rule firings (grafana.com/d/17319)
  • (Kubescape dashboard deferred — no stable upstream grafana.com ID
    for the OSS prometheus-exporter; gap tracked in
    tasks/security-stack-observe-integration.)

  PrometheusRule security-stack with 6 alerts, ordered by
  severity-of-failure-to-detect:

  Falco group:
  - FalcoKernelDrops (CRITICAL — THE SLO. Dropped kernel events
  = lost detections. Silent detection-loss
  is the worst failure mode.)
  - FalcoControllerUnavailable (WARNING — DS pods missing on N nodes;
  Auto Mode per-node pod cap, taints, etc.)
  - FalcoCriticalRuleFiring (CRITICAL — any Critical/Emergency Falco
  rule firing = active security incident)

  Trivy group:
  - TrivyScanFailing (WARNING — VulnerabilityReports go stale,
  CVE blind spots accumulate silently)
  - TrivyCriticalVulnerability (WARNING — workloads running with CRITICAL
  CVEs; Audit signal until admission lands)

  Kubescape group:
  - KubescapePostureRegression (WARNING — cluster_riskScore > 30)

  Both gated on $state.observe.enabled. Both land in monitoring namespace
  (same convention as observe-stack opencost dashboards).

  3 new KCL tests (18 total):

  • observe-default-composes-grafana-dashboards
  • observe-default-composes-prometheus-rules
  • observe-disabled-skips-dashboards-and-rules

  Verified on pat-local: dashboards "applied to 1 instances", PrometheusRule
  present with all 6 alerts loaded by Prometheus.

  Implements next half of [[tasks/security-stack-observe-integration]]

See full diff: v0.4.1...v0.5.0

v0.4.1

What's changed in v0.4.1

• fix: Falcosidekick direct Loki output instead of OTLP logs (by @patrickleet)

  Falcosidekick 2.31 chart does NOT expose an OTLP logs endpoint —
  only traces and metrics. The earlier OTLP-logs config was silently
  dropped on chart parse; the Enabled Outputs line read "[OTLPTraces]"
  without Loki.

  Switching to Falcosidekick's native loki output via
  spec.observe.lokiEndpoint (default http://loki-gateway.monitoring.svc.cluster.local).
  Now reports "Enabled Outputs: [Loki OTLPTraces]" — structured Falco
  events land in Loki for Grafana query.

  OTLP traces still flow to the Alloy receiver for Tempo correlation.

  Pipe-through-Alloy for enrichment / fan-out is a future iteration.

  Refs [[tasks/security-stack-observe-integration]]

See full diff: v0.4.0...v0.4.1

v0.4.0

What's changed in v0.4.0

• feat: ObserveStack integration toggle (spec.observe.enabled) (by @patrickleet)

  When spec.observe.enabled is true (default):

  • Trivy ServiceMonitor enabled
  • Falco metrics endpoint exposed + ServiceMonitor created (chart uses
    serviceMonitor.create, NOT enabled — different from falcosidekick)
  • Falcosidekick enabled with OTLP outputs to alloyReceiverEndpoint
    (default http://alloy-receiver.monitoring.svc.cluster.local:4318):
    • logs → /v1/logs → Loki via Alloy pipeline
    • traces → /v1/traces → Tempo via Alloy pipeline (syscall source only)
  • Falcosidekick ServiceMonitor created
  • Kubescape capabilities.prometheusExporter flipped to enable, AND
    kubescape.serviceMonitor.enabled set (chart gates SM on both)

  Pat-local platform Prometheus uses empty serviceMonitorSelector{} so no
  release-label requirement.

  Adds 3 KCL tests (15 total): observe-default-enables-telemetry,
  observe-disabled-turns-off-telemetry, observe-alloy-endpoint-override.

  Out of scope for this iteration:

  • PrometheusRule alerts (next iteration)
  • GrafanaDashboard CRs (next iteration)
  • Auto-discovery of alloy endpoint from ObserveStack XR status
  • Tempo trace correlation tuning

  Implements first half of [[tasks/security-stack-observe-integration]]

See full diff: v0.3.0...v0.4.0

v0.3.0

What's changed in v0.3.0

• feat: compose Kubescape StorageClass via spec.kubescape.storageClass (by @patrickleet)

  Removes the dependency on the cluster having a default StorageClass for
  the right CSI driver. Mirrors the knative-stack nats.storageClass pattern.

  XRD adds spec.kubescape.storageClass.{enabled, name, provisioner, parameters,
  reclaimPolicy, volumeBindingMode}. Defaults: name=kubescape, provisioner=
  ebs.csi.eks.amazonaws.com, parameters={type: gp3}, reclaimPolicy=Delete,
  volumeBindingMode=WaitForFirstConsumer.

  When the SC is composed, persistence.storageClass in the kubescape Helm
  values defaults to its name (still overridable via spec.kubescape.values).
  Disable via spec.kubescape.storageClass.enabled=false to fall back to the
  chart's "-" default (uses cluster default SC).

  3 new KCL tests (12/12 total): SC composed by default, overrides flow,
  disabled-skips-rendering.

  Replaces the local/securitystack.yaml loki opportunistic override.

  Implements [[tasks/security-stack-install]] follow-up

See full diff: v0.2.0...v0.3.0

v0.2.0

What's changed in v0.2.0

• feat: add Kubescape (kubescape-operator chart) as third helm release (by @patrickleet)

  Kubescape brings what Trivy + Falco can't:

  • Per-node CIS via DaemonSet host-scanner (works on EKS Auto Mode where
    Trivy's per-node Job-with-hostname-selector wedges)
  • K8s manifest posture against named frameworks: NSA, MITRE ATT&CK, CIS
  • Workload configuration scans → WorkloadConfigurationScan CRs

  Capabilities pre-tuned to complement (not duplicate) the existing stack:
  ENABLED: operator, configurationScan, continuousScan, nodeScan
  DISABLED: vulnerabilityScan/relevancy/nodeSbomGeneration (Trivy owns),
  runtimeDetection/malwareDetection/runtimeObservability/
  httpDetection (Falco owns), admissionController (Kyverno owns),
  networkPolicyService/manageWorkloads/seccompProfileService/etc.

  wait: false on the Release — Kubescape's host-scanner is a DaemonSet, same
  per-node-pod-cap rationale as Falco (see reference_helm_wait_for_daemonsets).

  XRD adds spec.kubescape.{enabled,namespace,releaseName,chartVersion,values,
  overrideAllValues}, status.kubescape.ready. Defaults: chart 1.40.1, namespace
  'kubescape', enabled=true. clusterName flows from spec.clusterName for
  Kubescape's multi-cluster discrimination.

  Verified on colima → pat-local EKS Auto Mode: all 3 Releases Ready,
  host-scanner DaemonSet scheduling without restricted-label issues.

  Resolves [[tasks/security-stack-kubescape-promote-v1]]

See full diff: v0.1.0...v0.2.0

v0.1.0

What's changed in v0.1.0

• feat: initial scaffold — Trivy Operator + Falco helm releases (by @patrickleet)

  Cloud-neutral security stack riding on policy-stack. First pass installs
  Trivy Operator + Falco as helm releases with sane defaults (modern_ebpf,
  falcosidekick off, no policies). Supply-chain ClusterPolicies, scan-result
  enforcement, sidekick OTel wiring, and observe-stack integration ship in
  subsequent iterations.

  Validated end-to-end on colima → pat-local EKS:

  • SecurityStack default/pat-local Ready=True
  • Trivy producing VulnerabilityReport CRs across the cluster
  • Falco DS deployed (partial node coverage — cluster capacity issue,
    not a stack issue)

  wait: false on Falco — DaemonSet readiness depends on per-node pod
  capacity; wait: true wedges on full nodes.

  Implements [[tasks/security-stack-install]]