apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ScanReceipt"
metadata:
  name: "cert-manager-default-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "45029db19d75e578bec74b82a0476a6580d1f7193239a210bf4873156ac725ce"
  result: "warn"
  scanner:
    name: "helm-expt-local-rendered-object-scan"
    version: "0.1.0"
  policyBundleDigest: "989c3b44723dbdf2dbeaa581bc8f10b067f71b4f88d5740dbe23e4b7e9820f4f"
  findingCounts:
    critical: 0
    high: 0
    medium: 26
    low: 0
    info: 0
  findings:
    -
      id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|MutatingWebhookConfiguration||cert-manager-webhook"
      rule: "admission-webhook-requires-observation"
      severity: "medium"
      object: "admissionregistration.k8s.io/v1|MutatingWebhookConfiguration||cert-manager-webhook"
      message: "Admission webhook availability must be observed after apply"
    -
      id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||cert-manager-webhook"
      rule: "admission-webhook-requires-observation"
      severity: "medium"
      object: "admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||cert-manager-webhook"
      message: "Admission webhook availability must be observed after apply"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cainjector"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cainjector"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cluster-view"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-cluster-view"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-approve:cert-manager-io"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-approve:cert-manager-io"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificates"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificates"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificatesigningrequests"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-certificatesigningrequests"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-challenges"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-challenges"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-clusterissuers"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-clusterissuers"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-ingress-shim"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-ingress-shim"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-issuers"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-issuers"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-orders"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-controller-orders"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-edit"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-edit"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-view"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-view"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-webhook:subjectaccessreviews"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||cert-manager-webhook:subjectaccessreviews"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-cainjector"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-cainjector"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-approve:cert-manager-io"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-approve:cert-manager-io"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificates"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificates"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificatesigningrequests"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-certificatesigningrequests"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-challenges"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-challenges"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-clusterissuers"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-clusterissuers"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-ingress-shim"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-ingress-shim"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-issuers"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-issuers"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-orders"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-controller-orders"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-webhook:subjectaccessreviews"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||cert-manager-webhook:subjectaccessreviews"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "helm-hook-lifecycle-policy:cert-manager-startupapicheck"
      rule: "helm-hook-lifecycle-policy"
      severity: "medium"
      object: "helm-hook|Job|cert-manager|cert-manager-startupapicheck"
      message: "cert-manager startup API check is a Helm post-install hook excluded by --no-hooks and needs lifecycle policy"