apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-dashboard-checkov
  namespace: grafana
  labels:
    grafana_dashboard: "1"
data:
  checkov-compliance.json: |
    {
      "annotations": { "list": [] },
      "editable": true,
      "panels": [
        {
          "title": "Checkov Scanner Job Status",
          "type": "timeseries",
          "datasource": { "type": "prometheus", "uid": "Prometheus" },
          "targets": [
            {
              "expr": "kube_job_status_succeeded{namespace=\"checkov\"}",
              "legendFormat": "Succeeded"
            },
            {
              "expr": "kube_job_status_failed{namespace=\"checkov\"}",
              "legendFormat": "Failed"
            }
          ],
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 }
        },
        {
          "title": "Last Successful Scan Age (hours)",
          "type": "stat",
          "datasource": { "type": "prometheus", "uid": "Prometheus" },
          "targets": [
            {
              "expr": "(time() - kube_cronjob_status_last_successful_time{namespace=\"checkov\", cronjob=\"checkov-scanner\"}) / 3600",
              "legendFormat": "Hours since last scan"
            }
          ],
          "fieldConfig": {
            "defaults": {
              "unit": "h",
              "thresholds": {
                "steps": [
                  { "color": "green", "value": 0 },
                  { "color": "yellow", "value": 25 },
                  { "color": "red", "value": 49 }
                ]
              }
            }
          },
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 }
        },
        {
          "title": "Kyverno Policy Violations (Audit Mode)",
          "type": "timeseries",
          "datasource": { "type": "prometheus", "uid": "Prometheus" },
          "targets": [
            {
              "expr": "sum(kyverno_policy_results_total{rule_result=\"fail\"}) by (policy_name)",
              "legendFormat": "{{policy_name}}"
            }
          ],
          "gridPos": { "h": 8, "w": 24, "x": 0, "y": 8 }
        },
        {
          "title": "Kyverno Pass vs Fail",
          "type": "piechart",
          "datasource": { "type": "prometheus", "uid": "Prometheus" },
          "targets": [
            {
              "expr": "sum(kyverno_policy_results_total) by (rule_result)",
              "legendFormat": "{{rule_result}}"
            }
          ],
          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 }
        },
        {
          "title": "Tetragon Security Events",
          "type": "stat",
          "datasource": { "type": "prometheus", "uid": "Prometheus" },
          "targets": [
            {
              "expr": "sum(rate(tetragon_events_total{type=~\"PROCESS_KPROBE|PROCESS_TRACEPOINT\"}[1h]))",
              "legendFormat": "Events/hr"
            }
          ],
          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 }
        }
      ],
      "schemaVersion": 39,
      "tags": ["checkov", "kyverno", "compliance", "zero-trust"],
      "time": { "from": "now-24h", "to": "now" },
      "title": "Zero Trust Compliance Overview",
      "uid": "zero-trust-compliance"
    }