apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ScanReceipt"
metadata:
  name: "kube-prometheus-stack-no-crds-r001"
spec:
  variantRevision: "../variant-revision.yaml"
  renderedObjectSetSHA256: "3f6049fc2b7a40bbfb009b347880e3f319a87c9b60a6fd274220287a10167fc2"
  result: "warn"
  scanner:
    name: "helm-expt-local-rendered-object-scan"
    version: "0.1.0"
  policyBundleDigest: "6f170071f5d1120d97bafc701e2a4631b2f01c313d5af5a1ec65943dcf69602a"
  findingCounts:
    critical: 0
    high: 7
    medium: 11
    low: 0
    info: 0
  findings:
    -
      id: "admission-webhook-requires-observation:admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||kube-prometheus-stack-admission"
      rule: "admission-webhook-requires-observation"
      severity: "medium"
      object: "admissionregistration.k8s.io/v1|ValidatingWebhookConfiguration||kube-prometheus-stack-admission"
      message: "Admission webhook availability must be observed after apply"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-grafana-clusterrole"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-grafana-clusterrole"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-kube-state-metrics"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-kube-state-metrics"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-operator"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-operator"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-prometheus"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRole||kube-prometheus-stack-prometheus"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-grafana-clusterrolebinding"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-grafana-clusterrolebinding"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-kube-state-metrics"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-kube-state-metrics"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-operator"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-operator"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "cluster-rbac-review:rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-prometheus"
      rule: "cluster-rbac-review"
      severity: "medium"
      object: "rbac.authorization.k8s.io/v1|ClusterRoleBinding||kube-prometheus-stack-prometheus"
      message: "Cluster-scoped RBAC requires production review"
    -
      id: "dependency-lock-review:umbrella"
      rule: "dependency-lock-review"
      severity: "medium"
      object: "dependency|crds,kube-state-metrics,prometheus-node-exporter,grafana,prometheus-windows-exporter"
      message: "Umbrella chart dependencies are locked before recipe publication"
    -
      id: "generated-secret-ownership:v1|Secret|monitoring|kube-prometheus-stack-grafana"
      rule: "generated-secret-ownership"
      severity: "medium"
      object: "v1|Secret|monitoring|kube-prometheus-stack-grafana"
      message: "Grafana admin credential is bound before render and needs explicit ownership before production promotion"
    -
      id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-coredns"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|kube-system|kube-prometheus-stack-coredns"
      message: "Service selector matches no rendered workload pod template"
    -
      id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-controller-manager"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|kube-system|kube-prometheus-stack-kube-controller-manager"
      message: "Service selector matches no rendered workload pod template"
    -
      id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-etcd"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|kube-system|kube-prometheus-stack-kube-etcd"
      message: "Service selector matches no rendered workload pod template"
    -
      id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-proxy"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|kube-system|kube-prometheus-stack-kube-proxy"
      message: "Service selector matches no rendered workload pod template"
    -
      id: "service-selector-has-workload-match:v1|Service|kube-system|kube-prometheus-stack-kube-scheduler"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|kube-system|kube-prometheus-stack-kube-scheduler"
      message: "Service selector matches no rendered workload pod template"
    -
      id: "service-selector-has-workload-match:v1|Service|monitoring|kube-prometheus-stack-alertmanager"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|monitoring|kube-prometheus-stack-alertmanager"
      message: "Service selector matches no rendered workload pod template"
    -
      id: "service-selector-has-workload-match:v1|Service|monitoring|kube-prometheus-stack-prometheus"
      rule: "service-selector-has-workload-match"
      severity: "high"
      object: "v1|Service|monitoring|kube-prometheus-stack-prometheus"
      message: "Service selector matches no rendered workload pod template"