apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "ScanReceipt" metadata: name: "external-secrets-default-r001" spec: variantRevision: "../variant-revision.yaml" renderedObjectSetSHA256: "bb3555fb22fc50b3cebf8a96068d20a887fcf58fc52cb3785704928cdaf40be3" result: "warn" scanner: name: "helm-expt-local-rendered-object-scan" version: "0.1.0" policyBundleDigest: "6db242f043d479d2f1f6a2db23e87a636cc424aeebdf950c2ccf0795ced79ab9" findingCounts: critical: 0 high: 0 medium: 36 low: 0 info: 0 findings: - id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||externalsecret-validate" rule: "admission-webhook-requires-observation" severity: "medium" object: "admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||externalsecret-validate" message: "Admission webhook availability must be observed after apply" - id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||secretstore-validate" rule: "admission-webhook-requires-observation" severity: "medium" object: "admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||secretstore-validate" message: "Admission webhook availability must be observed after apply" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-cert-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-cert-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-edit" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-edit" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-servicebindings" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-servicebindings" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||external-secrets-view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||external-secrets-cert-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||external-secrets-cert-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||external-secrets-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||external-secrets-controller" message: "Cluster-scoped RBAC requires production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||acraccesstokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||acraccesstokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||beyondtrustworkloadcredentialsdynamicsecrets.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||cloudsmithaccesstokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||cloudsmithaccesstokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clusterexternalsecrets.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clusterexternalsecrets.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clustergenerators.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clustergenerators.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clusterpushsecrets.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clusterpushsecrets.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clustersecretstores.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clustersecretstores.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||ecrauthorizationtokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||ecrauthorizationtokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||externalsecrets.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||externalsecrets.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||fakes.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||fakes.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||gcraccesstokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||gcraccesstokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||generatorstates.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||generatorstates.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||githubaccesstokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||githubaccesstokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||gitlabdeploytokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||gitlabdeploytokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||grafanas.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||grafanas.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||mfas.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||mfas.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||passwords.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||passwords.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||pushsecrets.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||pushsecrets.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||quayaccesstokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||quayaccesstokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||secretstores.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||secretstores.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||sshkeys.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||sshkeys.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||stssessiontokens.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||stssessiontokens.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||uuids.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||uuids.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||vaultdynamicsecrets.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||vaultdynamicsecrets.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||webhooks.generators.external-secrets.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||webhooks.generators.external-secrets.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "dependency-lock-review:bitwarden-sdk-server" rule: "dependency-lock-review" severity: "medium" object: "dependency|bitwarden-sdk-server|v0.6.0" message: "Disabled bitwarden-sdk-server dependency is locked and should remain disabled unless selected by a variant" - id: "webhook-secret-cert-controller-policy:v1|Secret|external-secrets|external-secrets-webhook" rule: "webhook-secret-cert-controller-policy" severity: "medium" object: "v1|Secret|external-secrets|external-secrets-webhook" message: "Webhook Secret certificate material is populated by cert-controller after apply and needs observation"