0023. Consolidation of Coverage Scanners into a Unified Auditor

• Status: accepted
• Date: 2026-06-04
• Deciders: lusoris
• Related: PR #1168

Context

Eleven scheduled coverage scanners each performed a similar cluster-wide list and maintained a separate issue stream. PR #1168 identified nine checks that could share one weekly sweep and two single-resource invariants that could be evaluated by Kyverno audit policies.

Decision

Fold nine scanners into the weekly cluster-coverage-auditor, with one ServiceAccount, cached paginated list pass, and grouped reconciled issue. Replace service-port-name-checker and ingress-class-coverage with audit-mode Kyverno ClusterPolicy resources and remove the eleven original Applications and charts.

Alternatives considered

Keep all eleven checks as separate scheduled scanners; rejected in favor of one shared sweep for the nine multi-resource checks. For the two admission-time invariants, use Kyverno audit reports instead of weekly list scans.

Consequences

apps/ai/cluster-coverage-auditor now implements the nine folded checks and reconciles their findings under one issue label. cluster/kyverno/service-port-name.yaml and cluster/kyverno/ingress-class-coverage.yaml now produce audit policy results for the other two checks, and the original eleven Argo CD Applications are absent.

References

• PR #1168 — chore(ai): consolidate 11 coverage scanners into cluster-coverage-auditor + 2 Kyverno policies (Wave 3)