The cluster started as three VMs on a Proxmox box. It's now six Talos nodes, a three-member etcd, and about forty services — all reconciled from a git repo by ArgoCD.
Everything through the repo
Nothing gets deployed by hand. A change lands in orion-services, ArgoCD notices,
the cluster converges. When something drifts, the repo is the truth and the
cluster is wrong — never the other way around.
The numbers lie
A scanner will happily tell you there are 119 critical vulnerabilities. Then you look, and it's six CVEs — Go's stdlib, gRPC, OpenSSL — counted once per image that happens to contain them. The newest upstream releases still carry them. There is nothing to upgrade to.
The useful question was never "how many criticals?" It was "how many have a fix that exists?"
Fewer moving parts
This post is a markdown file in the same repo as the site. No CMS, no database, no admin panel to patch. The best service is the one you didn't deploy.
What that looks like
The whole triage collapses to one question — does a fix exist?
kubectl get vulnerabilityreports -A -o json \
| jq '[.items[].report.vulnerabilities[]?
| select(.severity=="CRITICAL")
| select(.fixedVersion != "")] | length'| Scanner says | Actually fixable |
|---|---|
| 119 critical | 6 distinct CVEs |
The best service is the one you didn't deploy.