Skip to content

docs(kubescape): record the keep decision for the three unfalsifiable controls #3212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 2 commits into from
Aug 18, 2026
Merged

docs(kubescape): record the keep decision for the three unfalsifiable controls #3212

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ffcad19
docs(kubescape): record the keep decision for the three unfalsifiable…
devantler Aug 18, 2026
1d7c094
docs(kubescape): refresh the per-control suppression figures
devantler Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 16 additions & 9 deletions k8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,20 +41,27 @@ spec:
# - C-0002 (exec into container) -> exec-into-container-rbac.yaml
#
# The six controls listed in THIS CR do not all share that limitation, and
# three of them are load-bearing on the gating scan. Measured 2026-08-15 by
# running the CI scan twice, identical but for this one policy (ksail
# 7.178.20, `--framework nsa,mitre`):
# three of them are load-bearing on the gating scan. Measured by running the CI
# scan twice, identical but for this one policy (`--framework nsa,mitre`);
# C-0053 and C-0037 re-measured 2026-08-18, C-0031 as of 2026-08-15:
#
# C-0053 10 findings with this CR, 23 without -> suppresses 13
# C-0053 11 findings with this CR, 25 without -> suppresses 14
# C-0037 0 findings with this CR, 3 without -> suppresses 3
# C-0031 0 findings with this CR, 1 without -> suppresses 1
# C-0063 / C-0035 / C-0188: 0 findings in BOTH arms -> no observable
# effect either way on this surface. That makes them unproven here, not
# proven inert; decide them on evidence before removing them.
# C-0063 / C-0035 / C-0188: 0 findings in BOTH arms. These are KEPT, and the
# null result is not evidence against them: they sit outside NSA-CISA and
# MITRE, so this scan never evaluates them. Proof that "no change" does not
# mean "no effect" here — C-0037 also has a zero baseline, yet dropping it
# moves it 0 -> 3, while dropping these three moves nothing at all. That
# difference is the signature of a control the gate cannot see, not of a
# redundant exception. They do govern real findings on the surfaces that do
# evaluate them, so removing them on this scan's silence would strip a
# justified exception. Re-decide only if they come under a gated framework.
#
# So do NOT migrate these six to kind+name CRs on the assumption that a
# namespaceSelector cannot reach them: dropping this CR adds 17 findings to
# the posture gate. C-0053's residual 10 are all tenant-namespace
# namespaceSelector cannot reach them: dropping this CR adds 18 findings to
# the posture gate (14 + 3 + 1, summed from the per-control ablations above).
# C-0053's residual 11 are all tenant-namespace
# ServiceAccounts, none of them in the selector below, so they are correctly
# left flagged rather than evidence that this CR is incomplete.
#
Expand Down
Loading