apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "ScanReceipt" metadata: name: "kyverno-default-r001" spec: variantRevision: "../variant-revision.yaml" renderedObjectSetSHA256: "1596c72d8cde36995d7cd32ff3e953830da1763a59a25459c53ae4e4d425506d" result: "warn" scanner: name: "helm-expt-local-rendered-object-scan" version: "0.1.0" policyBundleDigest: "743f6ce209a0e83d5ed628ed507a02c74b97ccb48779cf65c261c743d20c5331" findingCounts: critical: 0 high: 0 medium: 68 low: 0 info: 0 findings: - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:admission-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:background-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:cleanup-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policies" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policies" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policies" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policies" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policyreports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policyreports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policyreports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:policyreports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:reports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:reports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:reports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:reports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:updaterequests" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:updaterequests" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:updaterequests" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:admin:updaterequests" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policies" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policies" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policies" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policies" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policyreports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policyreports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policyreports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:policyreports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:reports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:reports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:reports" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:reports" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:updaterequests" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:updaterequests" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:updaterequests" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:rbac:view:updaterequests" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller:core" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kyverno:reports-controller:core" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller:view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller:view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller:view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:admission-controller:view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller:view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller:view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller:view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:background-controller:view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:cleanup-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:cleanup-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:cleanup-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:cleanup-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller:view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller:view" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller:view" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kyverno:reports-controller:view" message: "Cluster-scoped RBAC requires production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||cleanuppolicies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||cleanuppolicies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clustercleanuppolicies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clustercleanuppolicies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clusterephemeralreports.reports.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clusterephemeralreports.reports.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clusterpolicies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clusterpolicies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||clusterpolicyreports.wgpolicyk8s.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||clusterpolicyreports.wgpolicyk8s.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||deletingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||deletingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||ephemeralreports.reports.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||ephemeralreports.reports.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||generatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||generatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||globalcontextentries.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||globalcontextentries.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||imagevalidatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||imagevalidatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||mutatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||mutatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||namespaceddeletingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||namespaceddeletingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedgeneratingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedgeneratingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedimagevalidatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedimagevalidatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedmutatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedmutatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedvalidatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||namespacedvalidatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||policyexceptions.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||policyexceptions.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||policyexceptions.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||policyexceptions.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||policyreports.wgpolicyk8s.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||policyreports.wgpolicyk8s.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||updaterequests.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||updaterequests.kyverno.io" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||validatingpolicies.policies.kyverno.io" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||validatingpolicies.policies.kyverno.io" message: "CRD ownership and upgrade behavior require production review"