monitoring: CVE-Pipeline v1 (gitops#47) - Scanner, Exporter, Regeln, Routing, Dashboard

- cve-scan: Trivy-Loop ueber die 29 real deployten Images (Cluster-Inventur
  2026-08-01 + Prod-Web-Image); 24h-Intervall, Fehler einzelner Images
  blockieren nicht
- cve-exporter: Stdlib-Exporter mit first_seen-State (Zeitstrahl), Schema
  trivy_vuln_info/_count/_first_seen/_last_scan gemaess Pflichtfeldern
- 3 Alertregeln (CRITICAL sofort, HIGH mit 24h-Daempfung, Scan-Frische) -
  promtool SUCCESS 9 rules; alle mit room=security
- matrix-alerts: Label-basiertes Raum-Routing (MATRIX_ROOM_<NAME>), Edits
  landen im richtigen Raum via State
- Grafana-Dashboard cve-overview: Severity-Stats, CVE-Tabelle mit
  NVD-Link/Fix-Version/first-seen, Zeitstrahl, Verlauf
UNGETESTET bis zum Deploy auf CFGMON (compose up -d).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj

monitoring/prometheus/alerts.yml

@@ -51,3 +51,32 @@ groups:
           severity: critical
         annotations:
           summary: "{{ $labels.instance }}: <10% Platz auf / frei"
+
+  # CVE-Pipeline (gitops#47): Funde aus den Trivy-Scans. Pflichtfelder je Alarm:
+  # CVE-ID, Mitigation (Fix-Version + NVD-Link), Ort (host), Typ (target_type);
+  # der Zeitstrahl kommt aus trivy_vuln_first_seen_timestamp + resolved-Edit.
+  # Alle Regeln routen per room-Label in den Security-Raum.
+  - name: axion-cve
+    rules:
+      - alert: TrivyCriticalVuln
+        expr: trivy_vuln_info{severity="CRITICAL"} == 1
+        labels:
+          severity: critical
+          room: security
+        annotations:
+          summary: "{{ $labels.cve }} (CRITICAL) in {{ $labels.target }} [{{ $labels.target_type }}@{{ $labels.host }}] — Paket {{ $labels.pkg }} {{ $labels.installed }}{{ if $labels.fixed_version }}, Fix: {{ $labels.fixed_version }}{{ else }}, noch kein Fix{{ end }} — https://nvd.nist.gov/vuln/detail/{{ $labels.cve }}"
+      - alert: TrivyHighVuln
+        expr: trivy_vuln_info{severity="HIGH"} == 1
+        for: 24h
+        labels:
+          severity: warning
+          room: security
+        annotations:
+          summary: "{{ $labels.cve }} (HIGH) in {{ $labels.target }} [{{ $labels.target_type }}@{{ $labels.host }}] — Paket {{ $labels.pkg }} {{ $labels.installed }}{{ if $labels.fixed_version }}, Fix: {{ $labels.fixed_version }}{{ else }}, noch kein Fix{{ end }} — https://nvd.nist.gov/vuln/detail/{{ $labels.cve }}"
+      - alert: TrivyScanStale
+        expr: time() - trivy_last_scan_timestamp > 172800
+        labels:
+          severity: warning
+          room: security
+        annotations:
+          summary: "CVE-Scan fuer {{ $labels.target }} ist aelter als 2 Tage — Scanner pruefen (ein still gestorbener Scanner macht blind)"