apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ScanReceipt"
metadata:
  name: "consul-secure-mesh-existing-secrets-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "0acc8c339c2965446b754c3a9c948c4f154ca6e47b074ddc3b8d315e2cb7c468"
  result: "warn"
  scanner:
    name: "helm-expt-local-rendered-object-scan"
    version: "0.1.0"
  policyBundleDigest: "2b91d2d514d317e84f0583f7b03ad786554573038b06c51539895083652b132b"
  findingCounts:
    critical: 0
    high: 0
    medium: 69
    low: 0
    info: 0
  findings:
    -
      id: "admission-webhook-review:admissionregistration.k8s.io/v1|MutatingWebhookConfiguration|consul|consul-consul-connect-injector"
      rule: "extension-slot-review"
      severity: "medium"
      object: "admissionregistration.k8s.io/v1|MutatingWebhookConfiguration|consul|consul-consul-connect-injector"
      message: "Consul injector webhook failure policy, certificates, and rollout impact require production review"
    -
      id: "admission-webhook-review:admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration|consul|consul-consul-connect-injector"
      rule: "extension-slot-review"
      severity: "medium"
      object: "admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration|consul|consul-consul-connect-injector"
      message: "Consul injector webhook failure policy, certificates, and rollout impact require production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-auth-method"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-auth-method"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-connect-injector"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-connect-injector"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-cleanup"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-cleanup"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-cleanup-custom"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-cleanup-custom"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-resources"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-resources"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-resources-custom"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-gateway-resources-custom"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-mesh-gateway"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-mesh-gateway"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-webhook-cert-manager"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||consul-consul-webhook-cert-manager"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole|consul|consul-consul-server"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole|consul|consul-consul-server"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-auth-method"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-auth-method"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-authdelegator"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-authdelegator"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-connect-injector"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-connect-injector"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-cleanup"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-cleanup"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-cleanup-custom"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-cleanup-custom"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-resources"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-resources"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-resources-custom"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-gateway-resources-custom"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-mesh-gateway"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-mesh-gateway"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-server"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-server"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-webhook-cert-manager"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||consul-consul-webhook-cert-manager"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|Role|consul|consul-consul-connect-inject-leader-election"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|Role|consul|consul-consul-connect-inject-leader-election"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|Role|consul|consul-consul-ingress-gateway"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|Role|consul|consul-consul-ingress-gateway"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|Role|consul|consul-consul-server"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|Role|consul|consul-consul-server"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|Role|consul|consul-consul-server-acl-init"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|Role|consul|consul-consul-server-acl-init"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|Role|consul|consul-consul-server-acl-init-cleanup"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|Role|consul|consul-consul-server-acl-init-cleanup"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|Role|consul|consul-consul-terminating-gateway"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|Role|consul|consul-consul-terminating-gateway"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-connect-inject-leader-election"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-connect-inject-leader-election"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-ingress-gateway"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-ingress-gateway"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-server"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-server"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-server-acl-init"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-server-acl-init"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-server-acl-init-cleanup"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-server-acl-init-cleanup"
      message: "Consul RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-terminating-gateway"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|RoleBinding|consul|consul-consul-terminating-gateway"
      message: "Consul RBAC requires production review"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||controlplanerequestlimits.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||controlplanerequestlimits.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||exportedservices.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||exportedservices.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||gatewayclassconfigs.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||gatewayclassconfigs.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||gatewayclasses.gateway.networking.k8s.io"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||gatewayclasses.gateway.networking.k8s.io"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||gatewaypolicies.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||gatewaypolicies.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||gateways.gateway.networking.k8s.io"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||gateways.gateway.networking.k8s.io"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||httproutes.gateway.networking.k8s.io"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||httproutes.gateway.networking.k8s.io"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||ingressgateways.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||ingressgateways.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||jwtproviders.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||jwtproviders.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||meshes.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||meshes.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||meshservices.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||meshservices.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||proxydefaults.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||proxydefaults.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||ratelimits.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||ratelimits.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||referencegrants.gateway.networking.k8s.io"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||referencegrants.gateway.networking.k8s.io"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||registrations.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||registrations.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||routeauthfilters.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||routeauthfilters.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||routeretryfilters.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||routeretryfilters.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||routetimeoutfilters.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||routetimeoutfilters.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||routetlssdsfilters.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||routetlssdsfilters.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||samenessgroups.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||samenessgroups.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||servicedefaults.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||servicedefaults.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||serviceintentions.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||serviceintentions.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||serviceresolvers.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||serviceresolvers.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||servicerouters.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||servicerouters.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||servicesplitters.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||servicesplitters.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||tcproutes.gateway.networking.k8s.io"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||tcproutes.gateway.networking.k8s.io"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||terminatinggateways.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||terminatinggateways.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||trafficpermissions.auth.consul.hashicorp.com"
      rule: "crd-upgrade-policy"
      severity: "medium"
      object: "apiextensions.k8s.io/v1|CustomResourceDefinition||trafficpermissions.auth.consul.hashicorp.com"
      message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy"
    -
      id: "edge-ingress-policy:networking.k8s.io/v1|Ingress|consul|consul-consul-ui"
      rule: "extension-slot-review"
      severity: "medium"
      object: "networking.k8s.io/v1|Ingress|consul|consul-consul-ui"
      message: "Consul UI ingress requires host, TLS, class, and edge policy review"
    -
      id: "extension-slot-review:consul"
      rule: "extension-slot-review"
      severity: "medium"
      object: "values|server.extraConfig|connectInject|controller|gateway|tpl-strings"
      message: "Consul server, injector, controller, gateway, and templated-string extension slots must be scanned when populated"
    -
      id: "lifecycle-job-review:batch/v1|Job|consul|consul-consul-server-acl-init"
      rule: "helm-hook-lifecycle-policy"
      severity: "medium"
      object: "batch/v1|Job|consul|consul-consul-server-acl-init"
      message: "Consul lifecycle Job must be tied to install/upgrade ordering and rollback policy"
    -
      id: "rendered-secret-ownership:v1|Secret|consul|consul-consul-auth-method"
      rule: "generated-secret-ownership"
      severity: "medium"
      object: "v1|Secret|consul|consul-consul-auth-method"
      message: "Rendered Consul Secret ownership, rotation, and observation policy require review"
    -
      id: "stateful-workload-review:apps/v1|StatefulSet|consul|consul-consul-server"
      rule: "deployment-workload-review"
      severity: "medium"
      object: "apps/v1|StatefulSet|consul|consul-consul-server"
      message: "Consul StatefulSet storage, rollout, and retention policy require production review"
    -
      id: "target-secret-fact:apps/v1|StatefulSet|consul|consul-consul-server:consul:ACL_BOOTSTRAP_TOKEN"
      rule: "generated-secret-ownership"
      severity: "medium"
      object: "apps/v1|StatefulSet|consul|consul-consul-server"
      message: "container consul references target Secret consul-bootstrap-acl-token/token"
    -
      id: "target-secret-fact:apps/v1|StatefulSet|consul|consul-consul-server:consul:GOSSIP_KEY"
      rule: "generated-secret-ownership"
      severity: "medium"
      object: "apps/v1|StatefulSet|consul|consul-consul-server"
      message: "container consul references target Secret consul-gossip-encryption-key/key"
    -
      id: "target-secret-policy:secure-mesh"
      rule: "generated-secret-ownership"
      severity: "medium"
      object: "values|global.tls|global.gossipEncryption|global.acls"
      message: "Secure Consul variants depend on target Secrets for TLS CA, server cert, gossip key, and ACL bootstrap token"