🤖 Generated by the Agentic Engineer
Problem
When the posture scanner cannot load its framework, it aborts and persists nothing — and the surfaces that consume its output cannot tell that apart from a healthy cluster with no findings. A broken scanner and a compliant cluster read identically.
That is what made #2933 silent for days: the CI posture gate stayed green throughout, and the stored scan data simply stopped moving. Repairing the immediate cause (#3023) restores scanning, but it does not make the next occurrence visible.
This criterion is called out on #2933 as the durable half, worth more than the immediate repair.
Expected behaviour
A scan run that fails to load its framework surfaces as a failure, not as a zero-finding clean result — loudly enough that it is noticed without anyone going to look.
Direction
Worth weighing, roughly increasing cost:
- Alert on scan staleness. The cheapest reliable signal — the stored scan data has an age, and an age past roughly one scan interval means the scanner is not working, whatever the reason. Catches framework-load failures and every other abort cause with one rule.
- Alert on the scanner's own failure log/metric, if it exposes one. More precise about cause, but only covers the causes it knows to report.
- Fail closed on emptiness. Any consumer treating "zero findings" as a pass should require positive evidence that a scan ran — this is the same shape as the CI gate's existing liveness problem.
Option 1 gets most of the value and is the suggested starting point. Note the platform already has an alerting path (Alertmanager runs in the kubescape namespace).
Acceptance criteria
Part of #2933.
Problem
When the posture scanner cannot load its framework, it aborts and persists nothing — and the surfaces that consume its output cannot tell that apart from a healthy cluster with no findings. A broken scanner and a compliant cluster read identically.
That is what made #2933 silent for days: the CI posture gate stayed green throughout, and the stored scan data simply stopped moving. Repairing the immediate cause (#3023) restores scanning, but it does not make the next occurrence visible.
This criterion is called out on #2933 as the durable half, worth more than the immediate repair.
Expected behaviour
A scan run that fails to load its framework surfaces as a failure, not as a zero-finding clean result — loudly enough that it is noticed without anyone going to look.
Direction
Worth weighing, roughly increasing cost:
Option 1 gets most of the value and is the suggested starting point. Note the platform already has an alerting path (Alertmanager runs in the
kubescapenamespace).Acceptance criteria
Part of #2933.