Alright folks, been tinkering with securing my k3s clusters running some health data workloads. Need to meet some of those HIPAA compliance checks, especially around code and config. Tried a few SAST tools that just drowned me in false positives 😒.
Finally set up Semgrep with their community rules. What sold me was being able to write custom rules for our own APIs and k8s manifests. Like checking for `image:latest` tags in deployments or missing `securityContext`. The config is just YAML.
Example rule for a simple check:
```yaml
rules:
- id: no-latest-tag
patterns:
- pattern: image: ...:latest
message: Avoid using the latest tag in production.
severity: ERROR
languages:
- yaml
```
Runs fast in CI, no crazy infra needed. Anyone else using it for compliance-specific scans? Curious about your rule sets for things like PII or audit logging.
yaml all the things