Security Posture
The agent walks every connected cluster on a 5-minute cycle and reports risky RBAC, NetworkPolicy coverage, running-image hygiene, PolicyReport failures and certificate expiry. Falco runtime alerts, vulnerability triage and in-cluster guardrails sit alongside it on one Security page.
Continuous Posture Audits
RBAC
Risky Role and ClusterRole bindings (wildcards, privilege-escalating verbs), highest severity first, with critical, warning and info counts per cluster.
NetworkPolicy Coverage
Every namespace graded as default-deny, partial or unrestricted, in the shape of CIS control 5.3.2.
Running Images
Every container and init container, flagged for mutable tags (latest or empty), specs without an @sha256 pin, and registries outside the tenant allow-list.
PolicyReports
Kubernetes PolicyReport results ingested per cluster. Fail, warn and error surface worst-first; pass and skip counts stay on the cluster summary.
Certificates
cert-manager Certificates and kubernetes.io/tls Secrets, bucketed as expired, expiring within 30 days, unreadable or healthy. Unmanaged Secrets are labelled as such.
Unknown Is Not Clean
A cluster that has never reported shows as unknown, never as clean. Tenant is stamped by the hub from the cluster registry, not by the agent.
Runtime Threat Alerts (Falco)
- Falco alerts stored per cluster and shown on the Security page runtime tab within seconds
- Push receiver for Falcosidekick webhook output or Falco native http_output: one alert or a JSON array of up to 1024 per request
- Bearer token is mandatory and delivered from a Kubernetes Secret; checked in constant time before the body is read, and the receiver refuses to start without one
- Off by default, runs only in the controller, exposed as an in-cluster ClusterIP Service
- Pull mode over the Falco gRPC Outputs API for clusters on Falco 0.43 or older
- Rule, priority, namespace, pod, container, process and host mapped onto every stored alert
Vulnerability Triage & EPSS
In-Cluster Guardrails
Deletion Protection
A servermind.io/prevent-deletion label or annotation (any value) makes delete a two-step action for non-admins: clear the marker, then delete. Honoured by delete, force-delete, cluster delete and Crossplane XR delete; Helm uninstall skips marked objects.
Protected Secrets
Label a Secret servermind.io/protected-secret=true and only an admin may mount it, inject it into env, use it as an image pull secret, or exec into a pod that already mounts it. Lookups fail closed.
Image Promote & Signing
A Kubernetes Job scans with Trivy (CRITICAL or HIGH blocks the mirror), copies with skopeo preserving digests, then signs with cosign using a key or keyless. Fans out across the fleet; verify Jobs require an identity and issuer in keyless mode.
Component Registry Allow-List
A deploy-time list confines which registries the ServerMind components themselves may be overridden to, on top of the admin-only check.
Policy Playground
Evaluate Rego against an AdmissionReview-shaped input on the hub engine, with strict builtins so typos fail to compile. Evaluation only: it does not enforce admission in any cluster.