# External Scan Lane

This lane runs a market-standard rendered-manifest scanner against the exact
supported top-20 rendered object sets.

It is additive to the existing local scan/gate receipts. It does not replace
ConfigHub function checks or chart-specific production dispositions.

## Tool Status

| Tool | Available | Version |
| --- | --- | --- |
| kube-linter | yes | 0.8.3 |
| Trivy | yes | Version: 0.71.1 |
| kubeconform | no | n/a |

## Summary

```text
charts scanned: 20
variant rendered object sets scanned: 42
pass: 0
warn: 42
fail: 0
total findings: 320
```

## Most Common Findings

| Check | Count |
| --- | ---: |
| `unset-memory-requirements` | 93 |
| `unset-cpu-requirements` | 87 |
| `no-read-only-root-fs` | 43 |
| `dangling-service` | 20 |
| `pdb-unhealthy-pod-eviction-policy` | 16 |
| `run-as-non-root` | 16 |
| `sensitive-host-mounts` | 9 |
| `liveness-port` | 8 |
| `readiness-port` | 8 |
| `startup-port` | 5 |
| `privilege-escalation-container` | 4 |
| `privileged-container` | 4 |

## Chart Workdown

The chart workdown groups variant findings into the next production action.
Use it with [production-disposition](../production-disposition/summary.md)
when closing `scan/gate warning disposition`.

| Chart | Variants | Findings | Priority | Top checks | Next action |
| --- | ---: | ---: | --- | --- | --- |
| `prometheus-community/kube-prometheus-stack@85.3.3` | 2 | 54 | high | dangling-service:14;unset-cpu-requirements:12;unset-memory-requirements:12;no-read-only-root-fs:6;sensitive-host-mounts:6;host-network:2;host-pid:2 | record security acceptance or create a hardened base; review service selectors and runtime endpoints; add production resource policy or accept chart defaults for local-test only; review pod security posture for the production target |
| `longhorn/longhorn@1.11.2` | 2 | 48 | high | no-read-only-root-fs:10;run-as-non-root:10;unset-cpu-requirements:10;unset-memory-requirements:10;dangling-service:4;privilege-escalation-container:2;privileged-container:2 | record security acceptance or create a hardened base; review service selectors and runtime endpoints; add production resource policy or accept chart defaults for local-test only; review pod security posture for the production target |
| `prometheus-community/prometheus@29.8.0` | 2 | 27 | high | unset-cpu-requirements:8;unset-memory-requirements:8;no-read-only-root-fs:6;sensitive-host-mounts:3;host-network:1;host-pid:1 | record security acceptance or create a hardened base; add production resource policy or accept chart defaults for local-test only; review pod security posture for the production target |
| `secrets-store-csi-driver/secrets-store-csi-driver@1.6.0` | 2 | 16 | high | no-read-only-root-fs:6;run-as-non-root:6;privilege-escalation-container:2;privileged-container:2 | record security acceptance or create a hardened base; review pod security posture for the production target |
| `bitnami/nginx@24.0.2` | 2 | 2 | standard | pdb-unhealthy-pod-eviction-policy:2 | accept PDB behavior or add a reviewed patch where the chart supports it |

## Interpretation

`warn` means the external scanner found issues that must receive a production
disposition before catalog production support is claimed. The rendered digest
is recorded per row, so each scanner result is bound to the exact objects we
would publish or install.