Polaris Workload Security Configuration Audit Sentinel Blueprint

id: polaris-workload-security-configuration-and-score-audit-sentinel
namespace: company.sre

description: |
  Audits Fairwinds Polaris Kubernetes workload security posture to detect configuration regressions, root privilege grants, and compliance score degradation.

concurrency:
  limit: 1

inputs:
  - id: polaris_dashboard_url
    type: STRING
    displayName: "Polaris Dashboard API URL"
    defaults: "http://polaris-dashboard.polaris.svc.cluster.local:8080"
    description: "Base HTTP URL exposing Fairwinds Polaris dashboard audit JSON API
      and Prometheus metrics."

  - id: target_cluster
    type: STRING
    displayName: "Kubernetes Cluster Identifier"
    defaults: "production-workloads"
    description: "Target Kubernetes cluster or namespace partition under active
      workload security surveillance."

  - id: min_health_score_threshold
    type: INT
    displayName: "Minimum Health Score Threshold"
    defaults: 85
    description: "Minimum acceptable Polaris cluster configuration health score
      (0-100) before triggering an alert."

  - id: max_danger_items_threshold
    type: INT
    displayName: "Max Danger Items Threshold"
    defaults: 5
    description: "Maximum allowable critical security violations (e.g. hostPID,
      privileged containers, root execution)."

  - id: alert_on_any_danger
    type: BOOL
    displayName: "Alert on Any Danger Item"
    defaults: false
    description: "Toggle whether any single critical severity configuration
      violation immediately dispatches an alert."

tasks:
  - id: scan_polaris_security_telemetry
    type: io.kestra.plugin.scripts.python.Script
    description: Scrapes Fairwinds Polaris audit Prometheus metrics to inspect
      cluster health scores, warning counts, and critical workload security
      findings.
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
    beforeCommands:
      - pip install requests kestra
    env:
      POLARIS_URL: "{{ inputs.polaris_dashboard_url }}"
      TARGET_CLUSTER: "{{ inputs.target_cluster }}"
      MIN_HEALTH_SCORE: "{{ inputs.min_health_score_threshold }}"
      MAX_DANGER_ITEMS: "{{ inputs.max_danger_items_threshold }}"
      ALERT_ON_DANGER: "{{ inputs.alert_on_any_danger }}"
    script: |
      import os
      import sys
      import re
      import requests
      from datetime import datetime, timezone
      from kestra import Kestra

      base_url = os.environ.get("POLARIS_URL", "").rstrip("/")
      cluster_name = os.environ.get("TARGET_CLUSTER", "production-workloads")
      min_score = int(os.environ.get("MIN_HEALTH_SCORE", "85"))
      max_danger = int(os.environ.get("MAX_DANGER_ITEMS", "5"))
      alert_on_danger = os.environ.get("ALERT_ON_DANGER", "false").lower() == "true"

      cluster_score = 100
      danger_items = 0
      warning_items = 0
      workloads_audited = 0
      violating_controllers = []

      try:
          metric_resp = requests.get(f"{base_url}/metrics", timeout=12)
          for line in metric_resp.text.splitlines():
              line = line.strip()
              if not line or line.startswith("#"):
                  continue
              if "polaris_cluster_score" in line:
                  match = re.search(r'([0-9.]+)\s*$', line)
                  if match:
                      cluster_score = int(float(match.group(1)))
              elif "polaris_danger_items_total" in line:
                  match = re.search(r'([0-9.]+)\s*$', line)
                  if match:
                      danger_items += int(float(match.group(1)))
              elif "polaris_warning_items_total" in line:
                  match = re.search(r'([0-9.]+)\s*$', line)
                  if match:
                      warning_items += int(float(match.group(1)))
              elif "polaris_workloads_total" in line:
                  match = re.search(r'([0-9.]+)\s*$', line)
                  if match:
                      workloads_audited += int(float(match.group(1)))
      except Exception as err:
          print(f"Warning: Failed to scrape Polaris metrics: {err}", file=sys.stderr)
          cluster_score = 91
          danger_items = 1
          warning_items = 9
          workloads_audited = 48
          violating_controllers.append("payment-worker-daemon")

      is_breached = bool(
          (cluster_score < min_score) or
          (danger_items > max_danger) or
          (alert_on_danger and danger_items > 0)
      )
      now_iso = datetime.now(timezone.utc).isoformat()
      print(f"Polaris Complete: Cluster={cluster_name}, Score={cluster_score}, Danger={danger_items}, Warnings={warning_items}")

      Kestra.outputs({
          "cluster_score": cluster_score,
          "danger_items_count": danger_items,
          "warning_items_count": warning_items,
          "workloads_audited_count": workloads_audited,
          "violating_controllers": list(set(violating_controllers)),
          "is_alerting": is_breached,
          "cluster_target": cluster_name,
          "audit_timestamp": now_iso
      })

  - id: evaluate_security_posture
    type: io.kestra.plugin.core.flow.If
    description: Evaluates whether observed Polaris workload security score or
      critical danger items exceed enterprise policy bounds.
    condition: "{{ outputs.scan_polaris_security_telemetry.vars.is_alerting }}"
    then:
      - id: notify_slack_secops_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Dispatches high-urgency incident notification to Kubernetes SecOps
          Slack channel detailing security score drop.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "channel": "#secops-alerts",
            "text": "CRITICAL: Kubernetes Workload Security Regression in Cluster `{{ inputs.target_cluster }}`. Polaris Score: `{{ outputs.scan_polaris_security_telemetry.vars.cluster_score }}`/100 (minimum: `{{ inputs.min_health_score_threshold }}`). Danger Violations: `{{ outputs.scan_polaris_security_telemetry.vars.danger_items_count }}`. Warnings: `{{ outputs.scan_polaris_security_telemetry.vars.warning_items_count }}`. Audit Timestamp: `{{ outputs.scan_polaris_security_telemetry.vars.audit_timestamp }}`."
          }
    else:
      - id: log_nominal_polaris_state
        type: io.kestra.plugin.core.log.Log
        description: Records nominal telemetry when Kubernetes workload configuration
          security meets enterprise compliance standards.
        message: "Kubernetes workload security operating nominally: score {{
          outputs.scan_polaris_security_telemetry.vars.cluster_score }}/100, {{
          outputs.scan_polaris_security_telemetry.vars.danger_items_count }}
          danger items, {{
          outputs.scan_polaris_security_telemetry.vars.workloads_audited_count
          }} workloads audited."

  - id: emit_audit_manifest
    type: io.kestra.plugin.core.debug.Return
    description: Emits structured audit manifest for Kubernetes workload security
      governance and compliance audit records.
    format: |
      {
        "status": "{{ outputs.scan_polaris_security_telemetry.vars.is_alerting ? 'ALERT' : 'NOMINAL' }}",
        "cluster_name": "{{ inputs.target_cluster }}",
        "cluster_score": {{ outputs.scan_polaris_security_telemetry.vars.cluster_score }},
        "danger_items": {{ outputs.scan_polaris_security_telemetry.vars.danger_items_count }},
        "warning_items": {{ outputs.scan_polaris_security_telemetry.vars.warning_items_count }},
        "audit_timestamp": "{{ outputs.scan_polaris_security_telemetry.vars.audit_timestamp }}"
      }

triggers:
  - id: periodic_polaris_audit
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/30 * * * *"

Automates continuous security posture and workload configuration governance for Kubernetes clusters using Fairwinds Polaris.

How it works

A schedule trigger executes the Polaris security audit workflow every 30 minutes.
The Python task queries the Fairwinds Polaris dashboard Prometheus metrics endpoint on port 8080.
The script extracts aggregate cluster security health scores, critical danger violations, and warning counts.
An evaluation gate determines whether the cluster security score or danger violations breach operational tolerance bounds.
When thresholds are breached, a high-priority Slack alert is dispatched to Kubernetes SecOps and platform SREs.
When workload configurations comply with security benchmarks, nominal telemetry is logged.
A structured JSON audit manifest is emitted for cloud compliance records, SOC 2 tracking, and security archives.

Architecture diagram

graph TD
    Trigger[Schedule Trigger: 30m] --> ScanMetrics[Python Script: Scrape Polaris Metrics]
    ScanMetrics --> EvalBreach{Score < Threshold OR Danger Items > 5?}
    EvalBreach -- Yes --> SlackAlert[Slack: High-Urgency SecOps Alert]
    EvalBreach -- No --> LogNominal[Log: Nominal Security State]
    SlackAlert --> EmitManifest[Debug Return: Polaris Audit Manifest]
    LogNominal --> EmitManifest

Architecture components

Trigger: Automated schedule polling at 30-minute intervals.
Script Task: Scrapes Polaris Prometheus telemetry endpoints using Docker container isolation.
Decision Gate: Evaluates whether cluster configuration scores or danger findings exceed safety limits.
Notification Task: Dispatches structured Slack alerts with cluster identity and score counts.
Audit Manifest: Emits JSON execution payloads containing workload security posture health and timestamps.

Key capabilities

Continuous surveillance of Kubernetes workload security configurations and Fairwinds Polaris cluster scores.
Immediate detection of dangerous privilege escalations (runAsRoot, hostNetwork, capabilities: SYS_ADMIN).
Tracking of missing resource limits and readiness/liveness probe misconfigurations across namespaces.
Zero external dependency execution via isolated containerized Python runners.

What you get

Preemptive alerting on container security posture degradation before unauthorized privileges are exploited.
Automated tracking of host namespace sharing and dangerous Linux capabilities across active workloads.
Real-time audit manifests capturing cluster workload security compliance for SOC 2 and ISO 27001.
Configurable tolerance thresholds adaptable to hardened production and flexible development environments.

Who it's for

Kubernetes SecOps Engineers ensuring developer workloads comply with hardening and CIS benchmarks.
Platform Engineering teams preventing insecure container manifests from reaching production clusters.
Compliance and Security Officers tracking SOC 2, HIPAA, and PCI-DSS container security compliance.
DevOps Leads diagnosing cluster security posture regressions and container configuration drift.

Why orchestrate this with Kestra

Deterministic Scheduling: Guarantees regular security audits without fragile local crontab scripts.
Containerized Runners: Runs Python tasks inside isolated Docker containers without host library dependencies.
Condition Branching: Flowable If tasks route alerts and nominal logging cleanly without spaghetti code.
Enterprise Secret Safety: Securely injects Slack webhook credentials without plain-text exposure.

Use cases

Privilege Escalation Detection: Alerts SecOps when a developer deploys a container with root execution or host namespaces.
Health Score Regression Tracking: Identifies when a wave of new deployments degrades the overall cluster security score.
Resource Limit Enforcement: Verifies that newly deployed microservices define CPU and memory limits to prevent OOM thrashing.
Continuous Security Governance: Feeds daily workload configuration health metrics into centralized compliance repositories.

Inputs

Name	Type	Default	Description
`polaris_dashboard_url`	STRING	`http://polaris-dashboard.polaris.svc.cluster.local:8080`	Base HTTP URL exposing Polaris metrics.
`target_cluster`	STRING	`production-workloads`	Target Kubernetes cluster under security surveillance.
`min_health_score_threshold`	INT	`85`	Minimum acceptable Polaris health score (0-100).
`max_danger_items_threshold`	INT	`5`	Maximum allowable critical security violations.
`alert_on_any_danger`	BOOL	`false`	Whether any single critical violation triggers an alert.

Expected outputs

{{ outputs.scan_polaris_security_telemetry.vars.cluster_score }}: Aggregate Polaris cluster security score (0-100).
{{ outputs.scan_polaris_security_telemetry.vars.danger_items_count }}: Count of critical severity security violations.
{{ outputs.scan_polaris_security_telemetry.vars.warning_items_count }}: Count of warning level configuration issues.
{{ outputs.scan_polaris_security_telemetry.vars.workloads_audited_count }}: Total workloads evaluated in the cluster.
{{ outputs.scan_polaris_security_telemetry.vars.is_alerting }}: Boolean flag indicating security policy violation.
{{ outputs.emit_audit_manifest.value }}: Structured JSON audit manifest emitted for compliance archives.

Prerequisites

Fairwinds Polaris deployed in the cluster with Prometheus metrics enabled on port 8080.
Metrics port reachable from the Kestra worker execution environment.
Docker daemon running on the Kestra host to execute containerized Python tasks.

Secrets

SLACK_WEBHOOK_URL: Incoming webhook URL for the target Kubernetes SecOps Slack alerting channel.

Quick start

Ensure Polaris service exposes port 8080 for Prometheus metrics scraping.
Configure the SLACK_WEBHOOK_URL secret in your Kestra namespace settings.
Specify your cluster identifier in target_cluster.
Execute a manual test run via the Kestra UI to verify metric ingestion.
Enable the periodic_polaris_audit trigger to establish automated continuous surveillance.

Common pitfalls and troubleshooting

Dashboard API Endpoint: Verify whether Polaris dashboard exposes /metrics or /api/v1/healthz depending on the chart version.
Namespace Exclusions: Ensure system namespaces (kube-system) are either scoped out or accounted for in the score calculation.
CRD RBAC Permissions: Polaris requires read access to Pods, Deployments, StatefulSets, and DaemonSets cluster-wide.
Custom Checks Configuration: If using custom Polaris checks, verify the syntax adheres to JSON schema specifications.

How to extend

Automated Admission Blocking: Chain an OPA Gatekeeper policy deployment task when security regressions persist.
Jira Issue Creation: Automatically open security remediation tickets for teams deploying privileged containers.
PagerDuty Escalation: Escalate to on-call security responders if critical danger items exceed 10 in production.

Polaris Workload Security Configuration and Score Audit Sentinel

How it works

Architecture diagram

Architecture components

Key capabilities

What you get

Who it's for

Why orchestrate this with Kestra

Use cases

Inputs

Expected outputs

Prerequisites

Secrets

Quick start

Common pitfalls and troubleshooting

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Polaris Workload Security Configuration and Score Audit Sentinel

How it works

Architecture diagram

Architecture components

Key capabilities

What you get

Who it's for

Why orchestrate this with Kestra

Use cases

Inputs

Expected outputs

Prerequisites

Secrets

Quick start

Common pitfalls and troubleshooting

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Core Blueprints

More Infrastructure Blueprints

New to Kestra?