The jump itself did exactly what gate 2 predicted: 278 high findings down to 89,
fifteen criticals to none, every component on the version the release ships. The
two flags I nearly forgot both earned their place — ingresses still publish the
public address, and the API certificate kept it.
What was expensive was not the version. A restart of the control plane tests
everything that leans on it, and two things did not come back on their own:
kube-state-metrics sat in crashloop, and alloy's log tailers died while logging
'will retry'. Twelve minutes without cluster logs, and nothing said so.
That same window emptied the metric the scan target set is derived from. The
query succeeded with zero rows, which counted as success, so the set fell from
54 to 12 and the next round deleted 42 reports — while coverage read 1.0. Three
rules I wrote the day before all stayed quiet, each for a defensible reason. The
gap sat exactly between them.
The stolperstein page for that failure class is marked harvested, and it is not:
the rule the framework took from it does not cover either case here. Both are
recorded there with what a future formulation would have to say instead.
Thore Cimbal
9bab4165fe