Repository navigation
Track security findings and closure progress in Coroot #5260
Description
🤖 Generated by the Agentic Engineer
User Story
As a platform owner, I want maintained Coroot dashboards that show remaining policy and security findings, scan coverage and closure progress, so that I can see how healthy the platform is and investigate what still prevents it from being green.
Acceptance Criteria
- Versioned Coroot dashboards reconcile idempotently and survive restore without duplicating or overwriting unrelated dashboards.
- Kyverno views show remaining failures, warnings, errors and skipped checks, with policy/namespace detail and historical trends.
- Kubescape views show posture and vulnerability findings plus coverage/freshness; missing, stale, incomplete or inconsistent data never reads as clean.
- Accepted risks remain visible and are distinguished from actual fixes. Runtime coverage is distinguished from proved detector/notification delivery.
- The overview leads to actionable findings and their existing delivery issues; falling counts are described as net change, never proof of individual closures.
- Tests cover healthy, unhealthy, missing-data and reconciliation cases; local and production manifests validate; the deployed dashboards are exercised in Coroot.
- Record which Policy Reporter responsibilities Coroot covers and retain any required exporter/API/detail service until replacement parity is observed.
- Document maintenance and activate through the protected deployment path after validation.
Part of #2447.
Implementation plan: use existing scanner result semantics and bounded metrics; provision closure-oriented dashboards through Coroot's native dashboard API; preserve the current reporting service during parity verification. Do not change security thresholds or exceptions to improve dashboard scores.
Metadata
Metadata
Assignees
Labels
No labels
Type
Fields
Priority
None yet
Start date
None yet
Target date
None yet
Effort
None yet
Projects
- Status
Activity
chore: agent-claim #5260 nonce=18fb7cf50f8c8eb5b90f24497c60aaaa
chore: agent-claim #5260 nonce=07de668e286d145e8c391436357b2306
devantler commentedon Oct 23, 2026
The dashboard component was implemented and merged in #5262. Its separate production activation is prepared and locally validated, but the post-merge health check found a newly blocked organization settings publication. The new publisher transition needs an explicit reviewed approval; #5265 tracks that repair. The previous verified publication remains stored.
Activation remains pending until the live failure is resolved. The activation patch is preserved, and all live dashboard acceptance checks remain open.
chore: agent-claim #5260 nonce=eae3d7a53b0e335fd36a22e40d4aaf44
devantler commentedon Oct 23, 2026
Delivered through preparation #5262 and production activation #5268. Activation head
0b655f020bb1ee28b5ff825e59fc0662c3f4683bmerged as88493c0f67e1e107f6c8715f61805b4ed227d709at 2026-10-23 15:48:21 UTC. Protected deployment and required checks passed on that merge-group revision.The three managed dashboards are Platform security progress, Kyverno remaining policy findings and Kubescape remediation progress. Live acceptance opened all three in the deployed Coroot UI and observed current collection, real findings, denominator-aware coverage gaps, full resource/image identities in legend titles, separate accepted/skipped/unknown outcomes, and zero/unproved assurance indicators. Resource legends were exercised. The three-hour range showed the newly collected samples; the day range had no usable history yet. Both daily net-change panels correctly remained empty without a 24-hour baseline. Falling counts are explicitly net change, not proof of individual closure.
Production read-back: collector generation and observed generation agree, its three containers are ready with no restarts, and the first natural reconciliation completed successfully at 15:45:15 UTC. All root Flux Kustomizations are Ready and unsuspended; the root OCI source is Ready and verified. A post-merge live health run returned
PLATFORM-HEALTH=OK.Validation includes healthy, unhealthy, missing/inconsistent data, project discovery, ownership collision, idempotent reconciliation, restoration and unmanaged-dashboard preservation cases; pinned helper images and released Coroot 1.22.2 browser checks passed at the exact activation head. Both prescribed manifest validation commands passed locally; hosted checks supplied full Helm validation where the local credential helper was unavailable.
Maintenance and interpretation guide: collection every five minutes, dashboard reconciliation every 15 minutes, versioned definitions and explicit protected disable/re-enable procedure. Existing metric retention is 14 days; meaningful daily comparison starts after the first 24 hours. Managed UI edits are reconciled from source.
Policy Reporter remains required for full report messages, exception views, policy metadata and its dedicated resource findings UI. Coroot now provides the overview, trends and prioritisation independently of that service's metrics exporter; this is not evidence of full replacement parity. Existing security remediation and runtime follow-ups #3156, #4263 and #4264 remain open, as does parent #2447. Broader publisher observation follow-up #5267 is separate and unresolved.