apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: checkov-alerts
  namespace: prometheus
  labels:
    release: kube-prometheus-stack
spec:
  groups:
    - name: checkov-security
      rules:
        - alert: CheckovScanJobFailed
          expr: kube_job_status_failed{namespace="checkov", job_name=~"checkov-scanner.*"} > 0
          for: 5m
          labels:
            severity: warning
          annotations:
            summary: "Checkov security scan job failed"
            description: "The Checkov IaC scanner CronJob has failed. Check logs for details."

        - alert: CheckovScanNotRunRecently
          expr: time() - kube_cronjob_status_last_successful_time{namespace="checkov", cronjob="checkov-scanner"} > 172800
          for: 1h
          labels:
            severity: warning
          annotations:
            summary: "Checkov scan has not run in 48+ hours"
            description: "The Checkov security scanner has not completed successfully in over 48 hours."