diff --git a/.secrets.baseline b/.secrets.baseline
index 127a329..90f2e66 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -3,7 +3,7 @@
"files": "go/go.sum|^.secrets.baseline$",
"lines": null
},
- "generated_at": "2024-06-06T13:02:33Z",
+ "generated_at": "2024-06-07T09:19:14Z",
"plugins_used": [
{
"name": "AWSKeyDetector"
@@ -82,7 +82,7 @@
"hashed_secret": "845d87d073c35614bfe1fe7f7f3821ea0f175126",
"is_secret": false,
"is_verified": false,
- "line_number": 289,
+ "line_number": 317,
"type": "Base64 High Entropy String",
"verified_result": null
}
diff --git a/README.md b/README.md
index f9997f9..a51d5e4 100644
--- a/README.md
+++ b/README.md
@@ -1,18 +1,46 @@
# 
Compliance-to-Policy (also known as `C2P`)
-## Introduction
-
-Compliance-to-Policy (C2P) bridges Compliance and PVPs. C2P takes Compliance requirements and generates technical policies for PVP, and takes PVP native results and generates Compliance Assessment Results.
-
-C2P supports Compliance and PVP as follows:
-- Compliance framework
- - Open Security Controls Assessment Language (OSCAL)
-- PVP
- - [Kyverno](https://kyverno.io/)
- - [Open Cluster Management Governance Policy Framework](https://open-cluster-management.io/)
- - [Auditree](https://auditree.github.io/)
+Compliance-to-Policy (C2P) is designed to bridge Compliance as Code such as Open Security Controls Assessment Language (OSCAL) and Policy as Code used by Policy Validation Point (PVP). It generates policies in native format of PVP from OSCAL Component Definitions and produces OSCAL Assessment Results from the native assessment results of PVP. C2P can be used both as a command-line tool and a Python library, making it easy and flexible to integrate into your Continuous Compliance pipelines, such as GitHub Actions, Tekton Pipelines, or Agile Authoring Pipelines. It supports multiple PVP engines, including [Kyverno](https://kyverno.io/), [Open Cluster Management Policy Framework](https://open-cluster-management.io/), and the open-source [Auditree](https://auditree.github.io/), through dedicated plugins for each. Custom plugins can be implemented with a small amount of Python code.
+
+
+
+1. Compliance-to-Policy (C2P) is running in GitOps Pipeline, Kubernetes controller, or Python/Go environment
+1. C2P receives Compliance as Code, for example OSCAL Component Definition that represents mapping between controls and policies (policy names/ids)
+1. C2P generates policies through plugin for each policy engine
+ - The plugin is responsible for implementing a function that takes policy names/ids and returns policies
+1. Policies are delivered to policy engines by GitOps sync, the subsequence pipeline task, Kubernetes controller, or a deployment automation program
+1. Results are collected from policy engines by a scheduled task or Kubernetes controller
+1. C2P aggregates the results of policy engines by controls through plugin for each policy engine
+ - The plugin is responsible for implementing a function that takes the results of the policy engine and returns verdicts (pass/fail/error), reason, and/or resource name for each respective policy by its names/IDs.
+1. C2P produces Compliance Assessment Results, for example OSCAL Assessment Results that represents the assessment results of each control
+
+Demo:
+- [Kyverno as PVP](docs/public/kyverno.md)
+- [Heterogeneous PVPs (mixing Kyverno, OCM Policy, and Auditree)](docs/public/heterogeneous.md)
-C2P reduces the cost to implement the interchange between Compliance artifacts and PVP proprietary artifacts. C2P is extensible to various PVPs through plugin.
+## Goals
+Provide seamless integration with compliance frameworks and existing policy engines, and enable to use heterogeneous policy engines in compliance check operation
+- Flexibility in choise of policy engines and compliance frameworks
+ - Provide plugins to cover various policy engines including proprietary/open source policy validation/enforcement engines, or in-house policy validation/enforcement program
+ - Cover various compliance frameworks not only OSCAL but also other GRC frameworks and Cloud Security Posture Management services
+- Community-driven plugin extension
+ - Provide an efficient plugin interface and development method
+
+## Supported Compliance Frameworks
+- [Open Security Controls Assessment Language (OSCAL)](https://pages.nist.gov/OSCAL/documentation/)
+ - OSCAL standard provides a compliance framework and the corresponding set of key compliance artifacts expressed in machine processable formats enabling all compliance documents to be treated as code and therefore processed and managed in the same manner.
+
+## Supported Policy Engines
+- [Kyverno](https://kyverno.io/) (for Kubernetes resources)
+ - Kyverno is a policy engine designed for Kubernetes, where policies are managed as Kubernetes resources. Kyverno policies can validate, mutate, generate, and clean up Kubernetes resources.
+- [Open Cluster Management Policy Framework](https://open-cluster-management.io/) (for Kubernetes resources)
+ - OCM is a multi-cluster management platform that provides governance of Kubernetes policies. [Its policy framework](https://open-cluster-management.io/concepts/policy/) allows for the validation and enforcement of policies across multiple clusters.
+- [Auditree](https://auditree.github.io/) (for any target, especially well-suited for resources of PaaS/SaaS/IaaS available through REST API.)
+ - Auditree is a GitOps based workflow automation that enables the collection and verification of evidence, building a long-term store of evidence in an git "evidence locker." Evidence is gathered by code scripts called "fetchers" and verified by "checks."
+
+Roadmap:
+- [OPA/Gatekeeper](https://github.com/open-policy-agent/gatekeeper) (for Kubernetes resources)
+- [Ansible](https://www.ansible.com/) (for any target, especially for VMs and OnPremise hosts)
## C2P in Go language
The Go verion is available in the [go directory](/go/README.md).
diff --git a/assets/architecture.drawio b/assets/architecture.drawio
new file mode 100644
index 0000000..1d31534
--- /dev/null
+++ b/assets/architecture.drawio
@@ -0,0 +1,138 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/assets/architecture.png b/assets/architecture.png
new file mode 100644
index 0000000..f141a22
Binary files /dev/null and b/assets/architecture.png differ
diff --git a/docs/public/images/assessment-results-md.kyverno.jpg b/docs/public/images/assessment-results-md.kyverno.jpg
deleted file mode 100644
index 42a553a..0000000
Binary files a/docs/public/images/assessment-results-md.kyverno.jpg and /dev/null differ
diff --git a/docs/public/kyverno.md b/docs/public/kyverno.md
index 9ffde2f..525f07c 100644
--- a/docs/public/kyverno.md
+++ b/docs/public/kyverno.md
@@ -1,10 +1,16 @@
-## Plugin for Kyverno
+## Work on Kyverno as PVP
+
+Usecase of security checks against Kubernetes resources by Kyverno.
+
+
#### Prerequisite
- Install KinD and Kyverno 1.10
#### Example usage of C2P
+1. (Optional) Create OSCAL Component Defintion
+ - [component-definition.csv](/plugins_public/tests/data/heterogeneous/component-definition.csv)
1. Generate Kyverno Policy (C2P Compliance to Policy)
```
python samples_public/kyverno/compliance_to_policy.py -o /tmp/deliverable-policy
@@ -58,6 +64,8 @@
```
1. OSCAL Assessment Results is not human readable format. You can see the merged report in markdown by a quick viewer.
```
- c2p tools viewer -ar /tmp/assessment_results.json -cdef ./plugins_public/tests/data/kyverno/component-definition.json -o /tmp/assessment_results.md
+ c2p tools viewer \
+ -cdef ./plugins_public/tests/data/kyverno/component-definition.json \
+ -ar /tmp/assessment_results.json
```
- 
\ No newline at end of file
+ e.g. [result.md](/docs/public/kyverno.result.md)
\ No newline at end of file
diff --git a/docs/public/kyverno.result.md b/docs/public/kyverno.result.md
new file mode 100644
index 0000000..0d0034e
--- /dev/null
+++ b/docs/public/kyverno.result.md
@@ -0,0 +1,628 @@
+
+
+## Component: Managed Kubernetes
+
+
+#### Result of control cm-2:
+
+
+
+Rule `allowed-base-images (Kyverno)`:
+- Building images which specify a base as their origin is a good start to improving supply chain security, but over time organizations may want to build an allow list of specific base images which are allowed to be used when constructing containers. This policy ensures that a container's base, found in an OCI annotation, is in a cluster-wide allow list.
+
+Details
+
+
+ - Subject UUID: 9dd754f9-107f-4bef-a8e8-1f6b48e99c18
+ - Title: v1/Pod kube-scheduler-kind-control-plane kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 9133c837-a326-4f97-9831-1b7aa07a06d6
+ - Title: v1/Pod coredns-5d78c9869d-gc25q kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 6a95995d-6604-468c-a7a9-3fbe41659d86
+ - Title: v1/Pod kindnet-pbb9l kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 0f8ace75-0260-4ec6-8c25-44d7465100dd
+ - Title: v1/Pod etcd-kind-control-plane kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 16719080-499e-4c3e-9bc5-a6c23c91c289
+ - Title: v1/Pod kube-apiserver-kind-control-plane kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 18249536-8126-46b3-8c71-704e4a0a8189
+ - Title: v1/Pod kube-proxy-zbddb kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 331edbaa-0c13-4734-8048-c97a83326eed
+ - Title: v1/Pod coredns-5d78c9869d-2rbnq kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 4e1947d2-24da-4544-83c6-4f7c9573ef9d
+ - Title: v1/Pod kube-controller-manager-kind-control-plane kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: f831cd49-b9f3-4c37-922b-ec4b3fc83ac7
+ - Title: apps/v1/DaemonSet kindnet kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: ad94a91f-944c-48bd-9d0d-a9917e9f36c6
+ - Title: apps/v1/DaemonSet kube-proxy kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: fae04582-1086-4372-ba26-4d75b679e08e
+ - Title: apps/v1/ReplicaSet coredns-5d78c9869d kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 4b029216-ab36-4aa7-b084-93dd38df5bc8
+ - Title: apps/v1/Deployment coredns kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 02840a50-7e97-427b-8a84-556e8ba00502
+ - Title: v1/Pod kyverno-admission-controller-7cd788c8dd-gdnhp kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 4323bb0e-42c8-4ff4-ad81-cfa63fbc7282
+ - Title: v1/Pod kyverno-reports-controller-7f94855747-tmnhr kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: e52ffeb4-5607-40c0-8c67-ef343f4659f1
+ - Title: v1/Pod kyverno-cleanup-admission-reports-28551310-cc4k7 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: d5341516-c240-4034-a3ae-47b3b0bb8efb
+ - Title: v1/Pod kyverno-cleanup-cluster-admission-reports-28551310-m4ld4 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 952284cc-7796-4951-8af0-31fa92fef354
+ - Title: v1/Pod kyverno-cleanup-controller-ddf458755-9bnlb kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 791320ee-d753-4a01-9cbb-46ee1290511b
+ - Title: v1/Pod kyverno-background-controller-74599787cf-s6nm2 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 40ee8280-f09f-413f-a6e3-ce64f081c040
+ - Title: apps/v1/Deployment kyverno-cleanup-controller kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: dca6df7a-db81-4cee-869e-7e44cc3b0f43
+ - Title: batch/v1/Job kyverno-cleanup-cluster-admission-reports-28551310 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 66d7a8c5-cb68-474d-830d-c30f1da9928f
+ - Title: apps/v1/ReplicaSet kyverno-admission-controller-7cd788c8dd kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 1d850dad-4bfe-4c73-95de-782ae6cc68d3
+ - Title: batch/v1/Job kyverno-cleanup-admission-reports-28551310 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: f4020009-ed61-43c4-a602-8077bcad4f45
+ - Title: apps/v1/Deployment kyverno-background-controller kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 85c061bd-9d9e-4d49-95ff-1c64b4d59ac5
+ - Title: apps/v1/ReplicaSet kyverno-cleanup-controller-ddf458755 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 940821f2-80b2-4fcc-9b84-4bfe19d31701
+ - Title: apps/v1/ReplicaSet kyverno-background-controller-74599787cf kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 101f7630-5f5e-42b8-821c-f9a5de4f302d
+ - Title: apps/v1/Deployment kyverno-reports-controller kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 7cd83df2-24eb-4c30-bb2f-531a2c01cb10
+ - Title: apps/v1/ReplicaSet kyverno-reports-controller-7f94855747 kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 52c44c56-c8bb-483a-97cb-3ef1099122ee
+ - Title: apps/v1/Deployment kyverno-admission-controller kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 6016287c-8669-4557-9a49-1740ac712b5f
+ - Title: batch/v1/CronJob kyverno-cleanup-cluster-admission-reports kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 4d0ca9de-f788-4078-8965-8799f0cd8dca
+ - Title: batch/v1/CronJob kyverno-cleanup-admission-reports kyverno
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: e3459a30-68dd-437d-a9d3-85094b81e599
+ - Title: v1/Pod local-path-provisioner-6bc4bddd6b-vlmww local-path-storage
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: 440394c6-0252-4522-adab-de16854e4363
+ - Title: apps/v1/ReplicaSet local-path-provisioner-6bc4bddd6b local-path-storage
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+
+ - Subject UUID: ab966e76-3149-4826-a4cf-62f2fb402faa
+ - Title: apps/v1/Deployment local-path-provisioner local-path-storage
+ - Result: failure :x:
+ - Reason:
+ ```
+ validation failure: This container image's base is not in the approved list or is not specified. Only pre-approved base images may be used. Please contact the platform team for assistance.
+ ```
+
+Details
+
+
+ - Subject UUID: 2a364519-28c5-4826-87ad-76f827642ee7
+ - Title: v1/Pod kube-scheduler-kind-control-plane kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: c7b43d71-f295-4f57-94a6-b10abc182317
+ - Title: v1/Pod coredns-5d78c9869d-gc25q kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: a7006a2b-4f28-4252-b43c-2399b2e57141
+ - Title: v1/Pod kindnet-pbb9l kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER, FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT) are disallowed.
+ ```
+
+
+ - Subject UUID: 9dfefd31-4aba-41e2-9cd9-3efe0879d6bc
+ - Title: v1/Pod etcd-kind-control-plane kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: a0d5f6c4-a18a-4a2b-9e43-42cafa584899
+ - Title: v1/Pod kube-apiserver-kind-control-plane kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: bad997e0-fbb9-4f1f-bf86-7a4149f065fb
+ - Title: v1/Pod kube-proxy-zbddb kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: ac0acce0-cc5c-4fe7-9e04-9d3e4b120ea3
+ - Title: v1/Pod coredns-5d78c9869d-2rbnq kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 41198c0b-4e36-48c3-9525-6e13307571ae
+ - Title: v1/Pod kube-controller-manager-kind-control-plane kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 66769f8f-f401-428e-be5e-291a717c157a
+ - Title: apps/v1/DaemonSet kindnet kube-system
+ - Result: failure :x:
+ - Reason:
+ ```
+ Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER, FSETID, KILL, MKNOD, NET_BIND_SERVICE, SETFCAP, SETGID, SETPCAP, SETUID, SYS_CHROOT) are disallowed.
+ ```
+
+
+ - Subject UUID: 32b5f436-404c-4ce7-b0eb-c7aeb4227b2d
+ - Title: apps/v1/DaemonSet kube-proxy kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 71903de3-edd3-41c2-bcb1-548deac9cd66
+ - Title: apps/v1/ReplicaSet coredns-5d78c9869d kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: d7b2e553-8484-4832-92c3-469b0ad87fdc
+ - Title: apps/v1/Deployment coredns kube-system
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 6db9c88c-05e9-49f6-9b54-e5b313ae5af5
+ - Title: v1/Pod kyverno-admission-controller-7cd788c8dd-gdnhp kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: e616181c-d6a8-48ff-adb9-596b5c0a9a39
+ - Title: v1/Pod kyverno-reports-controller-7f94855747-tmnhr kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 80b6f761-5f94-411d-a0ad-e744204bff81
+ - Title: v1/Pod kyverno-cleanup-admission-reports-28551310-cc4k7 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: e562bcec-aae8-4bf2-899a-676acc03f69d
+ - Title: v1/Pod kyverno-cleanup-cluster-admission-reports-28551310-m4ld4 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 247cafd6-ee9f-425f-82ff-6f4a28cb588d
+ - Title: v1/Pod kyverno-cleanup-controller-ddf458755-9bnlb kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: d119d142-4ece-4acb-b190-70178a1f83a9
+ - Title: v1/Pod kyverno-background-controller-74599787cf-s6nm2 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: addb8d0e-d015-4246-be86-9c46a02215f0
+ - Title: apps/v1/Deployment kyverno-cleanup-controller kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 5c586f26-b61b-42f5-9d50-a6ca5cb9ca5c
+ - Title: batch/v1/Job kyverno-cleanup-cluster-admission-reports-28551310 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 90b60a63-c2fb-4c8c-ab63-5265b6181952
+ - Title: apps/v1/ReplicaSet kyverno-admission-controller-7cd788c8dd kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 8dffcd26-1ba7-4cfd-b05b-e90f13fb12f3
+ - Title: batch/v1/Job kyverno-cleanup-admission-reports-28551310 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 1310f07c-2441-4d5d-80dd-02f20d60ca3a
+ - Title: apps/v1/Deployment kyverno-background-controller kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 33125904-5f8d-4738-876c-826f66762d2e
+ - Title: apps/v1/ReplicaSet kyverno-cleanup-controller-ddf458755 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: f2edb624-4092-479d-bc2f-af130a193133
+ - Title: apps/v1/ReplicaSet kyverno-background-controller-74599787cf kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: f6684749-6df8-42f1-b22f-6201c6f8159f
+ - Title: apps/v1/Deployment kyverno-reports-controller kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 943621bd-aa43-440c-94ca-30abf2b6aed9
+ - Title: apps/v1/ReplicaSet kyverno-reports-controller-7f94855747 kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 40170b0e-57ad-4f65-8cd4-f39bb4f7d681
+ - Title: apps/v1/Deployment kyverno-admission-controller kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: e3b87bce-ab5f-4d2f-8ed1-486130e38558
+ - Title: batch/v1/CronJob kyverno-cleanup-cluster-admission-reports kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-cronjob-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 9730a3f3-1e77-4037-954a-38b2317974fd
+ - Title: batch/v1/CronJob kyverno-cleanup-admission-reports kyverno
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-cronjob-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: 0b35bb44-2732-4367-8581-524704d65672
+ - Title: v1/Pod local-path-provisioner-6bc4bddd6b-vlmww local-path-storage
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: ce2b855d-2830-444b-8410-93fb01ca0d70
+ - Title: apps/v1/ReplicaSet local-path-provisioner-6bc4bddd6b local-path-storage
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+
+ - Subject UUID: b31b2ccb-68a3-4d93-9842-d33ea3f74809
+ - Title: apps/v1/Deployment local-path-provisioner local-path-storage
+ - Result: pass :white_check_mark:
+ - Reason:
+ ```
+ validation rule 'autogen-adding-capabilities' passed.
+ ```
+
+