apiVersion: "helm-expt.confighub.com/v1alpha1" kind: "ScanReceipt" metadata: name: "kube-prometheus-stack-default-r001" spec: variantRevision: "../variant-revision.yaml" renderedObjectSetSHA256: "c5dc2d69b5f9d0163166cd07485ee067e96702856fbdb5e0af3de88df0a348db" result: "warn" scanner: name: "helm-expt-local-rendered-object-scan" version: "0.1.0" policyBundleDigest: "d80d50015a2ec7372f8bfdc47bf2c610c282c68d5e0edcb9b781c2cc34323648" findingCounts: critical: 0 high: 7 medium: 19 low: 0 info: 0 findings: - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-grafana-clusterrole" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-grafana-clusterrole" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-kube-state-metrics" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-kube-state-metrics" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-operator" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-operator" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-prometheus" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-prometheus" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-grafana-clusterrolebinding" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-grafana-clusterrolebinding" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-kube-state-metrics" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-kube-state-metrics" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-operator" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-operator" message: "Cluster-scoped RBAC requires production review" - id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-prometheus" rule: "cluster-rbac-review" severity: "medium" object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-prometheus" message: "Cluster-scoped RBAC requires production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||alertmanagerconfigs.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||alertmanagerconfigs.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||alertmanagers.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||alertmanagers.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||podmonitors.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||podmonitors.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||probes.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||probes.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||prometheusagents.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||prometheusagents.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||prometheuses.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||prometheuses.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||prometheusrules.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||prometheusrules.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||scrapeconfigs.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||scrapeconfigs.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||servicemonitors.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||servicemonitors.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "crd-upgrade-policy:apiextensions.k8s.io/v1|CustomResourceDefinition||thanosrulers.monitoring.coreos.com" rule: "crd-upgrade-policy" severity: "medium" object: "apiextensions.k8s.io/v1|CustomResourceDefinition||thanosrulers.monitoring.coreos.com" message: "CRD ownership and upgrade behavior require production review" - id: "privileged-workload-review:apps/v1|DaemonSet|monitoring|kube-prometheus-stack-prometheus-node-exporter" rule: "privileged-workload-review" severity: "medium" object: "apps/v1|DaemonSet|monitoring|kube-prometheus-stack-prometheus-node-exporter" message: "Workload runs privileged or in a host namespace and requires production review" - id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-coredns" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|kube-system|kube-prometheus-stack-coredns" message: "Service selector matches no rendered workload pod template" - id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-controller-manager" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|kube-system|kube-prometheus-stack-kube-controller-manager" message: "Service selector matches no rendered workload pod template" - id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-etcd" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|kube-system|kube-prometheus-stack-kube-etcd" message: "Service selector matches no rendered workload pod template" - id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-proxy" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|kube-system|kube-prometheus-stack-kube-proxy" message: "Service selector matches no rendered workload pod template" - id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-scheduler" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|kube-system|kube-prometheus-stack-kube-scheduler" message: "Service selector matches no rendered workload pod template" - id: "service-selector-has-workload-match:v1|Service|monitoring|kube-prometheus-stack-alertmanager" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|monitoring|kube-prometheus-stack-alertmanager" message: "Service selector matches no rendered workload pod template" - id: "service-selector-has-workload-match:v1|Service|monitoring|kube-prometheus-stack-prometheus" rule: "service-selector-has-workload-match" severity: "high" object: "v1|Service|monitoring|kube-prometheus-stack-prometheus" message: "Service selector matches no rendered workload pod template"