apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "ScanReceipt" metadata: name: "cert-manager-crds-enabled-r001" spec: variantRevision: "../variant-revision.yaml" renderedObjectSetSHA256: "e288b2413bd1919173bee6afcd823be61399f101cfe2cf61f8e0df56740fefe0" result: "warn" scanner: name: "helm-expt-local-rendered-object-scan" version: "0.1.0" policyBundleDigest: "989c3b44723dbdf2dbeaa581bc8f10b067f71b4f88d5740dbe23e4b7e9820f4f" findingCounts: critical: 0 high: 0 medium: 32 low: 0 info: 0 findings: - id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|MutatingWebhookConfiguration||cert-manager-webhook" rule: "admission-webhook-requires-observation" severity: "medium" object: "admissionregistration.k8s.io/v1|MutatingWebhookConfiguration||cert-manager-webhook" message: "Admission webhook availability must be observed after apply" - id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||cert-manager-webhook" rule: "admission-webhook-requires-observation" severity: "medium" object: "admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||cert-manager-webhook" message: "Admission webhook availability must be observed after apply" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cainjector" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cainjector" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cluster-view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cluster-view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-approve:cert-manager-io" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-approve:cert-manager-io" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificates" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificates" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificatesigningrequests" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificatesigningrequests" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-challenges" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-challenges" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-clusterissuers" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-clusterissuers" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-ingress-shim" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-ingress-shim" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-issuers" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-issuers" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-orders" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-orders" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-edit" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-edit" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-webhook:subjectaccessreviews" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-webhook:subjectaccessreviews" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-cainjector" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-cainjector" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-approve:cert-manager-io" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-approve:cert-manager-io" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificates" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificates" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificatesigningrequests" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificatesigningrequests" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-challenges" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-challenges" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-clusterissuers" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-clusterissuers" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-ingress-shim" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-ingress-shim" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-issuers" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-issuers" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-orders" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-orders" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-webhook:subjectaccessreviews" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-webhook:subjectaccessreviews" message: "Cluster-scoped RBAC requires production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||certificaterequests.cert-manager.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||certificaterequests.cert-manager.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||certificates.cert-manager.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||certificates.cert-manager.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||challenges.acme.cert-manager.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||challenges.acme.cert-manager.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clusterissuers.cert-manager.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clusterissuers.cert-manager.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||issuers.cert-manager.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||issuers.cert-manager.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||orders.acme.cert-manager.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||orders.acme.cert-manager.io" message: "CRD readiness, ordering, schema validation, and upgrade compatibility require explicit policy" - id: "helm-hook-lifecycle-policy:cert-manager-startupapicheck" rule: "helm-hook-lifecycle-policy" severity: "medium" object: "helm-hook|Job|cert-manager|cert-manager-startupapicheck" message: "cert-manager startup API check is a Helm post-install hook excluded by --no-hooks and needs lifecycle policy"