Initial commit

infrastructure/checkov/manifests/prometheus-rules.yaml

@@ -0,0 +1,28 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: checkov-alerts
+  namespace: prometheus
+  labels:
+    release: kube-prometheus-stack
+spec:
+  groups:
+    - name: checkov-security
+      rules:
+        - alert: CheckovScanJobFailed
+          expr: kube_job_status_failed{namespace="checkov", job_name=~"checkov-scanner.*"} > 0
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Checkov security scan job failed"
+            description: "The Checkov IaC scanner CronJob has failed. Check logs for details."
+
+        - alert: CheckovScanNotRunRecently
+          expr: time() - kube_cronjob_status_last_successful_time{namespace="checkov", cronjob="checkov-scanner"} > 172800
+          for: 1h
+          labels:
+            severity: warning
+          annotations:
+            summary: "Checkov scan has not run in 48+ hours"
+            description: "The Checkov security scanner has not completed successfully in over 48 hours."