docs(security): correct the C-0013 gate rationale to the measured position

[devantler]

🤖 Generated by the Agentic Engineer

Why

The rationale block gating the cluster-wide C-0013 exception is now wrong, and wrong in the direction that costs work. It says five Flux controllers fail the control on a missing runAsGroup — but five of the six flux-system workloads have since been fixed and pass genuinely. Anyone picking this up today re-derives that from scratch, and the block points them at the wrong tracking issue for the one workload that is still failing.

It also hides a trap. The scan surface this gate was measured on used to report results before exceptions were applied; it no longer does. Every one of the six now reports passed — including the one that is genuinely broken — so the obvious way to check whether this gate can be lifted says "yes" when the answer is "no".

What

Rewrites the C-0013 rationale to state the current position: which five workloads set the field and at what uid, that the sole remaining gap is the retired tofu-controller, and that the gate clears when #3480 removes it rather than by patching a controller on its way out. Adds an explicit warning that the scan surface fails open here, naming the field that actually discriminates and the one that looks like it does but doesn't.

Comment and rationale text only — no change to which controls are suppressed or to any policy behaviour.

Part of #3223

[devantler]

🤖 Generated by the Agentic Engineer

First review request at this head. 354365f3 regenerates the committed headlamp exceptions mirror, which the corrected C-0013 rationale had left stale; TestCommittedMirrorIsUpToDate reproduced the failure locally, passes after the generator run, and a second generator run is byte-identical. 0 failing checks, 0 unresolved threads.

@coderabbitai review

[coderabbitai]

@devantler I will review the changes in #3481.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

User evaluation at 354365f3

Recording what was exercised, not merely reasoned about.

The defect. 354365f3 was pushed because the previous head left the committed mirror stale: the
C-0013 rationale is edited in the exception source and mirrored into
config-map-headlamp-exceptions.yaml by a generator, and only the source had been changed.

RED. go test ./scripts/generate-kubescape-exceptions at the previous head fails locally with
exactly the CI failure — TestCommittedMirrorIsUpToDate, config-map-headlamp-exceptions.yaml is out of date.

GREEN. After go run ./scripts/generate-kubescape-exceptions -format headlamp-configmap -o <mirror>, the same test passes. The file was regenerated, never hand-edited.

Idempotence control. Running the generator a second time produces a byte-identical file
(diff clean), so the committed mirror is genuinely the generator's fixed point rather than a
one-off that happens to satisfy the test.

Rendered-output controls. kubectl kustomize k8s/bases/infrastructure/controllers/kubescape
(48856 B) — the base that actually carries this ConfigMap, since a cluster overlay renders only Flux
Kustomization CRs and would not exercise it:

• positive: the corrected wording — one-workload gap in flux-system, tofu-controller, pending
  its removal in fix(flux-system): tofu-controller HelmRelease outlived its retirement and is permanently not-ready #3480 — appears in the rendered ConfigMap (1 occurrence);
• negative: the superseded "five-workload gap" wording is absent (0 occurrences).

The negative control is the half that matters: a positive match alone would not distinguish a
correct render from one where both wordings survived.

CI. 0 failing checks at this head, down from 1. The scan gate that was red is green.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d358944c-be7d-4610-aa84-3228df692c57

📥 Commits

Reviewing files that changed from the base of the PR and between 98e892d and 354365f.

📒 Files selected for processing (2)

• k8s/bases/infrastructure/cluster-security-exceptions/pod-security-mutations-unscoped.yaml
• k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: 🧪 Validate Manifests

🧰 Additional context used

📓 Path-based instructions (1)

Never run a cluster

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
• k8s/bases/infrastructure/cluster-security-exceptions/pod-security-mutations-unscoped.yaml

🧠 Learnings (1)

📚 Learning: 2026-08-11T12:41:28.242Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 3082
File: k8s/bases/infrastructure/controllers/coroot/cron-job-cnpg-degraded-alert.yaml:113-120
Timestamp: 2026-08-11T12:41:28.242Z
Learning: When changing behavior in Kubernetes manifests or related documentation, review comments and documentation in YAML/YML and Markdown files for statements describing the previous behavior. Update every stale statement in the same change so the repository’s explanatory text remains consistent with the implementation.

Applied to files:

• k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
• k8s/bases/infrastructure/cluster-security-exceptions/pod-security-mutations-unscoped.yaml

🔇 Additional comments (3)

k8s/bases/infrastructure/cluster-security-exceptions/pod-security-mutations-unscoped.yaml (2)

11-34: LGTM!

---

81-82: LGTM!

Also applies to: 89-90

k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml (1)

715-715: LGTM!

---

📝 Walkthrough

Walkthrough

The exception documentation now identifies tofu-controller as the sole remaining C-0013 gap. It records five passing Flux workloads and requires verification against live Deployment specifications. Tracking metadata references the pending removal. The controller exception reason now uses the same one-workload scope. The C-0211 scope remains 33 workloads.

Merge Risk: ⚪ Minimal · up to 35436

This change only corrects security-exception rationale and tracking text without changing controls or policy behavior; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the documentation change and the specific C-0013 gate rationale being corrected.
Description check	✅ Passed	The description directly explains the corrected C-0013 rationale, the remaining tofu-controller gap, scan behavior, and the lack of policy changes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}