diff --git a/docs/kyverno/kyverno-workflow.drawio b/docs/kyverno/kyverno-workflow.drawio
new file mode 100644
index 0000000..84cf800
--- /dev/null
+++ b/docs/kyverno/kyverno-workflow.drawio
@@ -0,0 +1,219 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/docs/kyverno/oscal-vs-kyverno-result-mapping.csv b/docs/kyverno/oscal-vs-kyverno-result-mapping.csv
new file mode 100644
index 0000000..b5c2dfa
--- /dev/null
+++ b/docs/kyverno/oscal-vs-kyverno-result-mapping.csv
@@ -0,0 +1,14 @@
+Field of OSCAL Assessment Result,How is Auditree check_results.json mapped,Field of Auditree check_results.json
+local-definitions.inventory-items[],Per check_result,check_results[]
+local-definitions.inventory-items[].props[].check_path,check_result key name,check_results[].$key
+local-definitions.inventory-items[].props[].accreditations,accreditations in check_result,check_results[].accreditations
+observations[],Per rule,
+observations[].subjects[],"Per check (filter(check_id in rule, check_results.$key.checks))","filter(lambda check: check in rule, check_results[].checks)"
+observations[].subjects[].subject_uuid,Inventory item id of the check,local-definitions.inventory-items[].uuid
+observations[].subjects[].props[].result,Status of check (pass/fail),check.status
+observations[].subjects[].props[].reason,Reason of the status,str(check.successes/failures/warnings)
+observations[].subjects[].props[].resource-id,Fully qualified check name ,f‘{check_result.$key}.{check.$key}’
+observations[].subjects[].props[].evaluate-on,Evaluation timestamp,check.timestamp_formatted
+observations[].relevant_references[].description,Evidence description,check_result.evidence[].description
+observations[].relevant_references[].href,Evidence urls,locker_url + check_result.evidence[].path
+observations[].links[].href,Report urls,locker_url + check_result.reports[]
\ No newline at end of file
diff --git a/docs/ocm.md b/docs/ocm/README.md
similarity index 65%
rename from docs/ocm.md
rename to docs/ocm/README.md
index 039fb1d..a48945e 100644
--- a/docs/ocm.md
+++ b/docs/ocm/README.md
@@ -1,32 +1,92 @@
## C2P for OCM
+### Usage
+```
+$ c2pcli ocm -h
+C2P CLI OCM plugin
+
+Usage:
+ c2pcli ocm [command]
+
+Available Commands:
+ oscal2policy Compose deliverable OCM Policies from OSCAL
+ oscal2posture Generate Compliance Posture from OSCAL artifacts
+ result2oscal Generate OSCAL Assessment Results from OCM Policy statuses
+
+Flags:
+ -h, --help help for ocm
+
+Use "c2pcli ocm [command] --help" for more information about a command.
+```
+
### Prerequisites
1. Install [Policy Generator Plugin](https://github.com/open-cluster-management-io/policy-generator-plugin#as-a-kustomize-plugin)
### Manual end-to-end use case
+
+1. Prerequisites
+ 1. OCM is configured to manage two k8s clusters (cluster1 and cluster2) and installed Policy Governance Framework.
+ 1. Namespace `c2p` is created in OCM Hub
+ 1. The managed clusters are labeled `my-cluster=true` and bound to `c2p` namespace
+ ```
+ $ clusteradm get clustersets
+
+
+ └──
+ │ ├──
+ │ ├── 2 ManagedClusters selected
+ │ ├── [cluster1 cluster2]
+ └──
+ │ ├──
+ │ ├── 2 ManagedClusters selected
+ │ ├── [cluster1 cluster2]
+ └──
+ └── c2p
+ └── 2 ManagedClusters selected
+ └── [cluster1 cluster2]
+ ```
1. Run oscal2policy
```
- c2pcli ocm oscal2policy -c c2p-config.yaml -o ./ocm-policies
+ c2pcli ocm oscal2policy -c ./docs/ocm/c2p-config.yaml -o /tmp/ocm-policies
```
+ - The generated ocm-policies directory looks like [./final-outputs/ocm-policies](./final-outputs/ocm-policies)
1. Deploy generated OCM Policies to OCM Hub
```
- kubectl create -f ./ocm-policies
+ kubectl create -f /tmp/ocm-policies
+ ```
+1. Wait for policies to be delivered
+ ```
+ $ kubectl get policy -A
+ NAMESPACE NAME REMEDIATION ACTION COMPLIANCE STATE AGE
+ c2p policy-deployment inform NonCompliant 5m15s
+ c2p policy-high-scan inform NonCompliant 5m15s
+ c2p policy-install-kyverno-from-manifests enforce Compliant 5m14s
+ c2p policy-kyverno-require-labels NonCompliant 5m14s
+ cluster1 c2p.policy-deployment inform NonCompliant 2m15s
+ cluster1 c2p.policy-high-scan inform NonCompliant 2m15s
+ cluster1 c2p.policy-install-kyverno-from-manifests enforce Compliant 2m14s
+ cluster1 c2p.policy-kyverno-require-labels NonCompliant 2m11s
+ cluster2 c2p.policy-deployment inform NonCompliant 2m15s
+ cluster2 c2p.policy-high-scan inform NonCompliant 2m15s
+ cluster2 c2p.policy-install-kyverno-from-manifests enforce Compliant 2m14s
+ cluster2 c2p.policy-kyverno-require-labels NonCompliant 2m11s
```
-1. Get OCM Policies from OCM Hub
+1. Get OCM Policy Results (Policy, PolicySet, PlacementDecision) from OCM Hub
```
- mkdir results
- kubectl get policies.policy.open-cluster-management.io -A -o yaml > ./results/policies.policy.open-cluster-management.io.yaml
- kubectl get policies.policy.open-cluster-management.io -A -o yaml > ./results/policies.policy.open-cluster-management.io.yaml
- kubectl get policysets.policy.open-cluster-management.io -A -o yaml > ./results/policysets.policy.open-cluster-management.io.yaml
+ mkdir /tmp/results
+ kubectl get policies.policy.open-cluster-management.io -A -o yaml > /tmp/results/policies.policy.open-cluster-management.io.yaml
+ kubectl get policysets.policy.open-cluster-management.io -A -o yaml > /tmp/results/policysets.policy.open-cluster-management.io.yaml
+ kubectl get placementdecisions.cluster.open-cluster-management.io -A -o yaml > /tmp/results/placementdecisions.cluster.open-cluster-management.io.yaml
```
1. Run result2oscal
```
- c2pcli ocm result2oscal -c c2p-config.yaml --results ./results -o ./assessment-results.json
+ c2pcli ocm result2oscal -c ./docs/ocm/c2p-config.yaml --results /tmp/results -o /tmp/assessment-results.json
```
-1. (Optional) Prettify OSCAL Assessment Results in .md format
+1. Prettify OSCAL Assessment Results in .md format
```
- c2pcli ocm oscal2posture -c c2p-config.yaml --assessment-results ./assessment-results.json -o compliance-posture.md
+ c2pcli ocm oscal2posture -c ./docs/ocm/c2p-config.yaml --assessment-results /tmp/assessment-results.json -o /tmp/compliance-posture.md
```
+ - You can view the compliance posture like [./final-outputs/compliance-posture.md](./final-outputs/compliance-posture.md)
### C2P Decomposer
Decompose OCM poicy collection to kubernetes resources composing each OCM policy (we call it policy resource).
diff --git a/docs/ocm/c2p-config.yaml b/docs/ocm/c2p-config.yaml
new file mode 100644
index 0000000..4ac0a1f
--- /dev/null
+++ b/docs/ocm/c2p-config.yaml
@@ -0,0 +1,16 @@
+compliance:
+ name: Demo Compliance
+ catalog:
+ url: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
+ profile:
+ url: ./docs/ocm/oscal/profile.json
+ componentDefinition:
+ url: ./docs/ocm/oscal/component-definition.json
+policyResources:
+ url: ./pkg/testdata/ocm/policies # example policy resources
+clusterGroups:
+ - name: myclusters
+ matchLabels:
+ my-cluster: 'true'
+target:
+ namespace: c2p
\ No newline at end of file
diff --git a/docs/ocm/final-outputs/assessment-results.json b/docs/ocm/final-outputs/assessment-results.json
new file mode 100755
index 0000000..012f242
--- /dev/null
+++ b/docs/ocm/final-outputs/assessment-results.json
@@ -0,0 +1,284 @@
+{
+ "assessment-results": {
+ "uuid": "6fae0aac-93fc-11ee-a02a-62f79297f1b7",
+ "metadata": {
+ "title": "OSCAL Assessment Results",
+ "last-modified": "2023-12-06T14:58:10.97827+09:00",
+ "version": "0.0.1",
+ "oscal-version": "1.0.4"
+ },
+ "import-ap": {
+ "href": "http://..."
+ },
+ "results": [
+ {
+ "uuid": "6fae0aac-93fc-11ee-a02b-62f79297f1b7",
+ "title": "Assessment Results by OCM",
+ "description": "Assessment Results by OCM...",
+ "start": "2023-12-06T14:58:10.97827+09:00",
+ "local-definitions": {
+ "inventory-items": [
+ {
+ "uuid": "6fade0d6-93fc-11ee-a029-62f79297f1b7",
+ "description": "",
+ "props": [
+ {
+ "name": "cluster-name",
+ "value": "cluster1"
+ }
+ ]
+ },
+ {
+ "uuid": "6fade374-93fc-11ee-a029-62f79297f1b7",
+ "description": "",
+ "props": [
+ {
+ "name": "cluster-name",
+ "value": "cluster2"
+ }
+ ]
+ }
+ ]
+ },
+ "observations": [
+ {
+ "uuid": "6fade810-93fc-11ee-a029-62f79297f1b7",
+ "description": "Observation of policy policy-high-scan",
+ "props": [
+ {
+ "name": "assessment-rule-id",
+ "value": "test_configuration_check"
+ },
+ {
+ "name": "policy-id",
+ "value": "policy-high-scan"
+ },
+ {
+ "name": "control-id",
+ "value": "cm-6"
+ },
+ {
+ "name": "result",
+ "value": "fail"
+ }
+ ],
+ "methods": [
+ "TEST-AUTOMATED"
+ ],
+ "subjects": [
+ {
+ "subject-uuid": "6fade0d6-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster1",
+ "props": [
+ {
+ "name": "result",
+ "value": "fail"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-high-scan.179e2849d01e8567\n lastTimestamp: \"2023-12-06T05:53:26Z\"\n message: NonCompliant; violation - couldn't find mapping resource with kind ScanSettingBinding,\n please check if you have CRD deployed\n- eventName: c2p.policy-high-scan.179e2848595f9ba9\n lastTimestamp: \"2023-12-06T05:53:20Z\"\n message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceSuite,\n please check if you have CRD deployed\n- eventName: c2p.policy-high-scan.179e284a97812778\n lastTimestamp: \"2023-12-06T05:53:30Z\"\n message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceCheckResult,\n please check if you have CRD deployed\n"
+ }
+ ]
+ },
+ {
+ "subject-uuid": "6fade374-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster2",
+ "props": [
+ {
+ "name": "result",
+ "value": "fail"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-high-scan.179e284863bfbfab\n lastTimestamp: \"2023-12-06T05:53:20Z\"\n message: NonCompliant; violation - couldn't find mapping resource with kind ScanSettingBinding,\n please check if you have CRD deployed\n- eventName: c2p.policy-high-scan.179e284a53812e10\n lastTimestamp: \"2023-12-06T05:53:28Z\"\n message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceSuite,\n please check if you have CRD deployed\n- eventName: c2p.policy-high-scan.179e2849950d51e5\n lastTimestamp: \"2023-12-06T05:53:25Z\"\n message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceCheckResult,\n please check if you have CRD deployed\n"
+ }
+ ]
+ }
+ ],
+ "collected": "0001-01-01T00:00:00Z",
+ "expires": "0001-01-01T00:00:00Z"
+ },
+ {
+ "uuid": "6fae067e-93fc-11ee-a029-62f79297f1b7",
+ "description": "Observation of policy policy-install-kyverno-from-manifests",
+ "props": [
+ {
+ "name": "assessment-rule-id",
+ "value": "install_kyverno"
+ },
+ {
+ "name": "policy-id",
+ "value": "policy-install-kyverno-from-manifests"
+ },
+ {
+ "name": "control-id",
+ "value": "cm-6"
+ },
+ {
+ "name": "result",
+ "value": "pass"
+ }
+ ],
+ "methods": [
+ "TEST-AUTOMATED"
+ ],
+ "subjects": [
+ {
+ "subject-uuid": "6fade0d6-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster1",
+ "props": [
+ {
+ "name": "result",
+ "value": "pass"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-install-kyverno-from-manifests.179e284be703d42d\n lastTimestamp: \"2023-12-06T05:53:35Z\"\n message: Compliant; notification - clusterroles [kyverno] found as specified, therefore\n this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284c7ace2ebf\n lastTimestamp: \"2023-12-06T05:53:38Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-generaterequest]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284c9f4c379e\n lastTimestamp: \"2023-12-06T05:53:38Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-policies] found as\n specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e28504ffc7000\n lastTimestamp: \"2023-12-06T05:53:54Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-policyreport] found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284befa43976\n lastTimestamp: \"2023-12-06T05:53:35Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-reports] found as\n specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284e6ff55461\n lastTimestamp: \"2023-12-06T05:53:46Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-updaterequest] found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285349215bae\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - clusterroles [kyverno:events] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284d380ed6df\n lastTimestamp: \"2023-12-06T05:53:41Z\"\n message: Compliant; notification - clusterroles [kyverno:generate] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2853548333b1\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - clusterroles [kyverno:policies] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284f80c03d5d\n lastTimestamp: \"2023-12-06T05:53:51Z\"\n message: Compliant; notification - clusterroles [kyverno:userinfo] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284ba3c9f6ea\n lastTimestamp: \"2023-12-06T05:53:34Z\"\n message: Compliant; notification - clusterroles [kyverno:view] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e28535e612839\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - clusterroles [kyverno:webhook] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284fcb71f4df\n lastTimestamp: \"2023-12-06T05:53:52Z\"\n message: Compliant; notification - clusterrolebindings [kyverno] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285680fe6ac8\n lastTimestamp: \"2023-12-06T05:54:21Z\"\n message: Compliant; notification - configmaps [kyverno-metrics] in namespace kyverno\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e28524f386c75\n lastTimestamp: \"2023-12-06T05:54:03Z\"\n message: Compliant; notification - configmaps [kyverno] in namespace kyverno found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284bf8f4b48b\n lastTimestamp: \"2023-12-06T05:53:35Z\"\n message: Compliant; notification - customresourcedefinitions [admissionreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284bba53764a\n lastTimestamp: \"2023-12-06T05:53:34Z\"\n message: Compliant; notification - customresourcedefinitions [backgroundscanreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284fd5dac2d0\n lastTimestamp: \"2023-12-06T05:53:52Z\"\n message: Compliant; notification - customresourcedefinitions [clusteradmissionreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284f91c7ac2d\n lastTimestamp: \"2023-12-06T05:53:51Z\"\n message: Compliant; notification - customresourcedefinitions [clusterbackgroundscanreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2853336f0121\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - customresourcedefinitions [clusterpolicies.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2853ae517829\n lastTimestamp: \"2023-12-06T05:54:09Z\"\n message: Compliant; notification - customresourcedefinitions [clusterpolicyreports.wgpolicyk8s.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2853bb96886f\n lastTimestamp: \"2023-12-06T05:54:09Z\"\n message: Compliant; notification - customresourcedefinitions [generaterequests.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e28567b4ab101\n lastTimestamp: \"2023-12-06T05:54:21Z\"\n message: Compliant; notification - customresourcedefinitions [policies.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285155b5a7dc\n lastTimestamp: \"2023-12-06T05:53:58Z\"\n message: Compliant; notification - customresourcedefinitions [policyreports.wgpolicyk8s.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285258c5e5f7\n lastTimestamp: \"2023-12-06T05:54:03Z\"\n message: Compliant; notification - customresourcedefinitions [updaterequests.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2856c0192717\n lastTimestamp: \"2023-12-06T05:54:22Z\"\n message: Compliant; notification - deployments [kyverno] in namespace kyverno found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851d0ebe5d4\n lastTimestamp: \"2023-12-06T05:54:01Z\"\n message: Compliant; notification - namespaces [kyverno] found as specified, therefore\n this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851d422c597\n lastTimestamp: \"2023-12-06T05:54:01Z\"\n message: Compliant; notification - roles [kyverno:leaderelection] in namespace kyverno\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e28526cb03284\n lastTimestamp: \"2023-12-06T05:54:03Z\"\n message: Compliant; notification - rolebindings [kyverno:leaderelection] in namespace\n kyverno found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285684956927\n lastTimestamp: \"2023-12-06T05:54:21Z\"\n message: Compliant; notification - services [kyverno-svc-metrics] in namespace kyverno\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285277e643d2\n lastTimestamp: \"2023-12-06T05:54:03Z\"\n message: Compliant; notification - services [kyverno-svc] in namespace kyverno found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2855b441709c\n lastTimestamp: \"2023-12-06T05:54:17Z\"\n message: Compliant; notification - serviceaccounts [kyverno] in namespace kyverno\n found as specified, therefore this Object template is compliant\n"
+ }
+ ]
+ },
+ {
+ "subject-uuid": "6fade374-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster2",
+ "props": [
+ {
+ "name": "result",
+ "value": "pass"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-install-kyverno-from-manifests.179e284c9a97c784\n lastTimestamp: \"2023-12-06T05:53:38Z\"\n message: Compliant; notification - clusterroles [kyverno] found as specified, therefore\n this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284b35375584\n lastTimestamp: \"2023-12-06T05:53:32Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-generaterequest]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284ef4862c6a\n lastTimestamp: \"2023-12-06T05:53:48Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-policies] found as\n specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284dfd646310\n lastTimestamp: \"2023-12-06T05:53:44Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-policyreport] found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284dc9cf5a21\n lastTimestamp: \"2023-12-06T05:53:43Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-reports] found as\n specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284b3482ad78\n lastTimestamp: \"2023-12-06T05:53:32Z\"\n message: Compliant; notification - clusterroles [kyverno:admin-updaterequest] found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284f07938a0b\n lastTimestamp: \"2023-12-06T05:53:49Z\"\n message: Compliant; notification - clusterroles [kyverno:events] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284f17ff00f6\n lastTimestamp: \"2023-12-06T05:53:49Z\"\n message: Compliant; notification - clusterroles [kyverno:generate] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284ca95ae428\n lastTimestamp: \"2023-12-06T05:53:38Z\"\n message: Compliant; notification - clusterroles [kyverno:policies] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284e30919d74\n lastTimestamp: \"2023-12-06T05:53:45Z\"\n message: Compliant; notification - clusterroles [kyverno:userinfo] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284e4527ba38\n lastTimestamp: \"2023-12-06T05:53:45Z\"\n message: Compliant; notification - clusterroles [kyverno:view] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284c5820f7b0\n lastTimestamp: \"2023-12-06T05:53:37Z\"\n message: Compliant; notification - clusterroles [kyverno:webhook] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284dccc3cae5\n lastTimestamp: \"2023-12-06T05:53:43Z\"\n message: Compliant; notification - clusterrolebindings [kyverno] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285889d4069c\n lastTimestamp: \"2023-12-06T05:54:29Z\"\n message: Compliant; notification - configmaps [kyverno-metrics] in namespace kyverno\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2853e3c830c7\n lastTimestamp: \"2023-12-06T05:54:09Z\"\n message: Compliant; notification - configmaps [kyverno] in namespace kyverno found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851c8b54cb1\n lastTimestamp: \"2023-12-06T05:54:00Z\"\n message: Compliant; notification - customresourcedefinitions [admissionreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284dda99ee7e\n lastTimestamp: \"2023-12-06T05:53:44Z\"\n message: Compliant; notification - customresourcedefinitions [backgroundscanreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e284cbfda9c70\n lastTimestamp: \"2023-12-06T05:53:39Z\"\n message: Compliant; notification - customresourcedefinitions [clusteradmissionreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2854d3f7806a\n lastTimestamp: \"2023-12-06T05:54:13Z\"\n message: Compliant; notification - customresourcedefinitions [clusterbackgroundscanreports.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2856e1ae7593\n lastTimestamp: \"2023-12-06T05:54:22Z\"\n message: Compliant; notification - customresourcedefinitions [clusterpolicies.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851eb3a6bea\n lastTimestamp: \"2023-12-06T05:54:01Z\"\n message: Compliant; notification - customresourcedefinitions [clusterpolicyreports.wgpolicyk8s.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851282fb972\n lastTimestamp: \"2023-12-06T05:53:58Z\"\n message: Compliant; notification - customresourcedefinitions [generaterequests.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851fa561a0e\n lastTimestamp: \"2023-12-06T05:54:01Z\"\n message: Compliant; notification - customresourcedefinitions [policies.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2854e6af9e7a\n lastTimestamp: \"2023-12-06T05:54:14Z\"\n message: Compliant; notification - customresourcedefinitions [policyreports.wgpolicyk8s.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285334bd6234\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - customresourcedefinitions [updaterequests.kyverno.io]\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e28588a2bd302\n lastTimestamp: \"2023-12-06T05:54:29Z\"\n message: Compliant; notification - deployments [kyverno] in namespace kyverno found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2851d0e23da9\n lastTimestamp: \"2023-12-06T05:54:01Z\"\n message: Compliant; notification - namespaces [kyverno] found as specified, therefore\n this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2853398624f1\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - roles [kyverno:leaderelection] in namespace kyverno\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2858b1db4b8e\n lastTimestamp: \"2023-12-06T05:54:30Z\"\n message: Compliant; notification - rolebindings [kyverno:leaderelection] in namespace\n kyverno found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2857bc2aa4bd\n lastTimestamp: \"2023-12-06T05:54:26Z\"\n message: Compliant; notification - services [kyverno-svc-metrics] in namespace kyverno\n found as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e285346ad8e3c\n lastTimestamp: \"2023-12-06T05:54:07Z\"\n message: Compliant; notification - services [kyverno-svc] in namespace kyverno found\n as specified, therefore this Object template is compliant\n- eventName: c2p.policy-install-kyverno-from-manifests.179e2857c388cf77\n lastTimestamp: \"2023-12-06T05:54:26Z\"\n message: Compliant; notification - serviceaccounts [kyverno] in namespace kyverno\n found as specified, therefore this Object template is compliant\n"
+ }
+ ]
+ }
+ ],
+ "collected": "0001-01-01T00:00:00Z",
+ "expires": "0001-01-01T00:00:00Z"
+ },
+ {
+ "uuid": "6fae08e0-93fc-11ee-a029-62f79297f1b7",
+ "description": "Observation of policy policy-kyverno-require-labels",
+ "props": [
+ {
+ "name": "assessment-rule-id",
+ "value": "test_required_label"
+ },
+ {
+ "name": "policy-id",
+ "value": "policy-kyverno-require-labels"
+ },
+ {
+ "name": "control-id",
+ "value": "cm-6"
+ },
+ {
+ "name": "result",
+ "value": "fail"
+ }
+ ],
+ "methods": [
+ "TEST-AUTOMATED"
+ ],
+ "subjects": [
+ {
+ "subject-uuid": "6fade0d6-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster1",
+ "props": [
+ {
+ "name": "result",
+ "value": "fail"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-kyverno-require-labels.179e2851c11fe04c\n lastTimestamp: \"2023-12-06T05:54:00Z\"\n message: Compliant; notification - clusterpolicies [require-labels] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-kyverno-require-labels.179e2862688eaee7\n lastTimestamp: \"2023-12-06T05:55:12Z\"\n message: 'NonCompliant; violation - policyreports found: [cpol-require-labels] in\n namespace local-path-storage'\n"
+ }
+ ]
+ },
+ {
+ "subject-uuid": "6fade374-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster2",
+ "props": [
+ {
+ "name": "result",
+ "value": "fail"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-kyverno-require-labels.179e2855f5ab92dd\n lastTimestamp: \"2023-12-06T05:54:18Z\"\n message: Compliant; notification - clusterpolicies [require-labels] found as specified,\n therefore this Object template is compliant\n- eventName: c2p.policy-kyverno-require-labels.179e2862e1802d28\n lastTimestamp: \"2023-12-06T05:55:14Z\"\n message: 'NonCompliant; violation - policyreports found: [cpol-require-labels] in\n namespace local-path-storage'\n"
+ }
+ ]
+ }
+ ],
+ "collected": "0001-01-01T00:00:00Z",
+ "expires": "0001-01-01T00:00:00Z"
+ },
+ {
+ "uuid": "6fae0aac-93fc-11ee-a029-62f79297f1b7",
+ "description": "Observation of policy policy-deployment",
+ "props": [
+ {
+ "name": "assessment-rule-id",
+ "value": "test_proxy_check"
+ },
+ {
+ "name": "policy-id",
+ "value": "policy-deployment"
+ },
+ {
+ "name": "control-id",
+ "value": "cm-2"
+ },
+ {
+ "name": "result",
+ "value": "fail"
+ }
+ ],
+ "methods": [
+ "TEST-AUTOMATED"
+ ],
+ "subjects": [
+ {
+ "subject-uuid": "6fade0d6-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster1",
+ "props": [
+ {
+ "name": "result",
+ "value": "fail"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-deployment.179e284f776397b3\n lastTimestamp: \"2023-12-06T05:53:50Z\"\n message: 'NonCompliant; violation - deployments not found: [nginx-deployment] in\n namespace cluster1 missing; [nginx-deployment] in namespace default missing; [nginx-deployment]\n in namespace kube-node-lease missing; [nginx-deployment] in namespace kube-public\n missing; [nginx-deployment] in namespace kyverno missing; [nginx-deployment] in\n namespace local-path-storage missing'\n"
+ }
+ ]
+ },
+ {
+ "subject-uuid": "6fade374-93fc-11ee-a029-62f79297f1b7",
+ "type": "resource",
+ "title": "Cluster Name: cluster2",
+ "props": [
+ {
+ "name": "result",
+ "value": "fail"
+ },
+ {
+ "name": "reason",
+ "value": "- eventName: c2p.policy-deployment.179e2854bed6d22e\n lastTimestamp: \"2023-12-06T05:54:13Z\"\n message: 'NonCompliant; violation - deployments not found: [nginx-deployment] in\n namespace cluster2 missing; [nginx-deployment] in namespace default missing; [nginx-deployment]\n in namespace kube-node-lease missing; [nginx-deployment] in namespace kube-public\n missing; [nginx-deployment] in namespace kyverno missing; [nginx-deployment] in\n namespace local-path-storage missing'\n"
+ }
+ ]
+ }
+ ],
+ "collected": "0001-01-01T00:00:00Z",
+ "expires": "0001-01-01T00:00:00Z"
+ }
+ ]
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/docs/ocm/final-outputs/compliance-posture.md b/docs/ocm/final-outputs/compliance-posture.md
new file mode 100755
index 0000000..f8d4366
--- /dev/null
+++ b/docs/ocm/final-outputs/compliance-posture.md
@@ -0,0 +1,401 @@
+## Catalog
+Electronic Version of NIST SP 800-53 Rev 5.1.1 Controls and SP 800-53A Rev 5.1.1 Assessment Procedures
+## Component: Managed Kubernetes
+#### Result of control: cm-6
+
+Rule ID: test_configuration_check
+Details
+
+ - Subject UUID: 6fade0d6-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster1
+ - Result: fail
+ - Reason:
+ ```
+ - eventName: c2p.policy-high-scan.179e2849d01e8567
+ lastTimestamp: "2023-12-06T05:53:26Z"
+ message: NonCompliant; violation - couldn't find mapping resource with kind ScanSettingBinding,
+ please check if you have CRD deployed
+ - eventName: c2p.policy-high-scan.179e2848595f9ba9
+ lastTimestamp: "2023-12-06T05:53:20Z"
+ message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceSuite,
+ please check if you have CRD deployed
+ - eventName: c2p.policy-high-scan.179e284a97812778
+ lastTimestamp: "2023-12-06T05:53:30Z"
+ message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceCheckResult,
+ please check if you have CRD deployed
+
+ ```
+
+ - Subject UUID: 6fade374-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster2
+ - Result: fail
+ - Reason:
+ ```
+ - eventName: c2p.policy-high-scan.179e284863bfbfab
+ lastTimestamp: "2023-12-06T05:53:20Z"
+ message: NonCompliant; violation - couldn't find mapping resource with kind ScanSettingBinding,
+ please check if you have CRD deployed
+ - eventName: c2p.policy-high-scan.179e284a53812e10
+ lastTimestamp: "2023-12-06T05:53:28Z"
+ message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceSuite,
+ please check if you have CRD deployed
+ - eventName: c2p.policy-high-scan.179e2849950d51e5
+ lastTimestamp: "2023-12-06T05:53:25Z"
+ message: NonCompliant; violation - couldn't find mapping resource with kind ComplianceCheckResult,
+ please check if you have CRD deployed
+
+ ```
+Details
+
+ - Subject UUID: 6fade0d6-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster1
+ - Result: pass
+ - Reason:
+ ```
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284be703d42d
+ lastTimestamp: "2023-12-06T05:53:35Z"
+ message: Compliant; notification - clusterroles [kyverno] found as specified, therefore
+ this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284c7ace2ebf
+ lastTimestamp: "2023-12-06T05:53:38Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-generaterequest]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284c9f4c379e
+ lastTimestamp: "2023-12-06T05:53:38Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-policies] found as
+ specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e28504ffc7000
+ lastTimestamp: "2023-12-06T05:53:54Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-policyreport] found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284befa43976
+ lastTimestamp: "2023-12-06T05:53:35Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-reports] found as
+ specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284e6ff55461
+ lastTimestamp: "2023-12-06T05:53:46Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-updaterequest] found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285349215bae
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - clusterroles [kyverno:events] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284d380ed6df
+ lastTimestamp: "2023-12-06T05:53:41Z"
+ message: Compliant; notification - clusterroles [kyverno:generate] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2853548333b1
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - clusterroles [kyverno:policies] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284f80c03d5d
+ lastTimestamp: "2023-12-06T05:53:51Z"
+ message: Compliant; notification - clusterroles [kyverno:userinfo] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284ba3c9f6ea
+ lastTimestamp: "2023-12-06T05:53:34Z"
+ message: Compliant; notification - clusterroles [kyverno:view] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e28535e612839
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - clusterroles [kyverno:webhook] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284fcb71f4df
+ lastTimestamp: "2023-12-06T05:53:52Z"
+ message: Compliant; notification - clusterrolebindings [kyverno] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285680fe6ac8
+ lastTimestamp: "2023-12-06T05:54:21Z"
+ message: Compliant; notification - configmaps [kyverno-metrics] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e28524f386c75
+ lastTimestamp: "2023-12-06T05:54:03Z"
+ message: Compliant; notification - configmaps [kyverno] in namespace kyverno found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284bf8f4b48b
+ lastTimestamp: "2023-12-06T05:53:35Z"
+ message: Compliant; notification - customresourcedefinitions [admissionreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284bba53764a
+ lastTimestamp: "2023-12-06T05:53:34Z"
+ message: Compliant; notification - customresourcedefinitions [backgroundscanreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284fd5dac2d0
+ lastTimestamp: "2023-12-06T05:53:52Z"
+ message: Compliant; notification - customresourcedefinitions [clusteradmissionreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284f91c7ac2d
+ lastTimestamp: "2023-12-06T05:53:51Z"
+ message: Compliant; notification - customresourcedefinitions [clusterbackgroundscanreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2853336f0121
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - customresourcedefinitions [clusterpolicies.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2853ae517829
+ lastTimestamp: "2023-12-06T05:54:09Z"
+ message: Compliant; notification - customresourcedefinitions [clusterpolicyreports.wgpolicyk8s.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2853bb96886f
+ lastTimestamp: "2023-12-06T05:54:09Z"
+ message: Compliant; notification - customresourcedefinitions [generaterequests.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e28567b4ab101
+ lastTimestamp: "2023-12-06T05:54:21Z"
+ message: Compliant; notification - customresourcedefinitions [policies.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285155b5a7dc
+ lastTimestamp: "2023-12-06T05:53:58Z"
+ message: Compliant; notification - customresourcedefinitions [policyreports.wgpolicyk8s.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285258c5e5f7
+ lastTimestamp: "2023-12-06T05:54:03Z"
+ message: Compliant; notification - customresourcedefinitions [updaterequests.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2856c0192717
+ lastTimestamp: "2023-12-06T05:54:22Z"
+ message: Compliant; notification - deployments [kyverno] in namespace kyverno found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851d0ebe5d4
+ lastTimestamp: "2023-12-06T05:54:01Z"
+ message: Compliant; notification - namespaces [kyverno] found as specified, therefore
+ this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851d422c597
+ lastTimestamp: "2023-12-06T05:54:01Z"
+ message: Compliant; notification - roles [kyverno:leaderelection] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e28526cb03284
+ lastTimestamp: "2023-12-06T05:54:03Z"
+ message: Compliant; notification - rolebindings [kyverno:leaderelection] in namespace
+ kyverno found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285684956927
+ lastTimestamp: "2023-12-06T05:54:21Z"
+ message: Compliant; notification - services [kyverno-svc-metrics] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285277e643d2
+ lastTimestamp: "2023-12-06T05:54:03Z"
+ message: Compliant; notification - services [kyverno-svc] in namespace kyverno found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2855b441709c
+ lastTimestamp: "2023-12-06T05:54:17Z"
+ message: Compliant; notification - serviceaccounts [kyverno] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+
+ ```
+
+ - Subject UUID: 6fade374-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster2
+ - Result: pass
+ - Reason:
+ ```
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284c9a97c784
+ lastTimestamp: "2023-12-06T05:53:38Z"
+ message: Compliant; notification - clusterroles [kyverno] found as specified, therefore
+ this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284b35375584
+ lastTimestamp: "2023-12-06T05:53:32Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-generaterequest]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284ef4862c6a
+ lastTimestamp: "2023-12-06T05:53:48Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-policies] found as
+ specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284dfd646310
+ lastTimestamp: "2023-12-06T05:53:44Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-policyreport] found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284dc9cf5a21
+ lastTimestamp: "2023-12-06T05:53:43Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-reports] found as
+ specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284b3482ad78
+ lastTimestamp: "2023-12-06T05:53:32Z"
+ message: Compliant; notification - clusterroles [kyverno:admin-updaterequest] found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284f07938a0b
+ lastTimestamp: "2023-12-06T05:53:49Z"
+ message: Compliant; notification - clusterroles [kyverno:events] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284f17ff00f6
+ lastTimestamp: "2023-12-06T05:53:49Z"
+ message: Compliant; notification - clusterroles [kyverno:generate] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284ca95ae428
+ lastTimestamp: "2023-12-06T05:53:38Z"
+ message: Compliant; notification - clusterroles [kyverno:policies] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284e30919d74
+ lastTimestamp: "2023-12-06T05:53:45Z"
+ message: Compliant; notification - clusterroles [kyverno:userinfo] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284e4527ba38
+ lastTimestamp: "2023-12-06T05:53:45Z"
+ message: Compliant; notification - clusterroles [kyverno:view] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284c5820f7b0
+ lastTimestamp: "2023-12-06T05:53:37Z"
+ message: Compliant; notification - clusterroles [kyverno:webhook] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284dccc3cae5
+ lastTimestamp: "2023-12-06T05:53:43Z"
+ message: Compliant; notification - clusterrolebindings [kyverno] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285889d4069c
+ lastTimestamp: "2023-12-06T05:54:29Z"
+ message: Compliant; notification - configmaps [kyverno-metrics] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2853e3c830c7
+ lastTimestamp: "2023-12-06T05:54:09Z"
+ message: Compliant; notification - configmaps [kyverno] in namespace kyverno found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851c8b54cb1
+ lastTimestamp: "2023-12-06T05:54:00Z"
+ message: Compliant; notification - customresourcedefinitions [admissionreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284dda99ee7e
+ lastTimestamp: "2023-12-06T05:53:44Z"
+ message: Compliant; notification - customresourcedefinitions [backgroundscanreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e284cbfda9c70
+ lastTimestamp: "2023-12-06T05:53:39Z"
+ message: Compliant; notification - customresourcedefinitions [clusteradmissionreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2854d3f7806a
+ lastTimestamp: "2023-12-06T05:54:13Z"
+ message: Compliant; notification - customresourcedefinitions [clusterbackgroundscanreports.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2856e1ae7593
+ lastTimestamp: "2023-12-06T05:54:22Z"
+ message: Compliant; notification - customresourcedefinitions [clusterpolicies.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851eb3a6bea
+ lastTimestamp: "2023-12-06T05:54:01Z"
+ message: Compliant; notification - customresourcedefinitions [clusterpolicyreports.wgpolicyk8s.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851282fb972
+ lastTimestamp: "2023-12-06T05:53:58Z"
+ message: Compliant; notification - customresourcedefinitions [generaterequests.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851fa561a0e
+ lastTimestamp: "2023-12-06T05:54:01Z"
+ message: Compliant; notification - customresourcedefinitions [policies.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2854e6af9e7a
+ lastTimestamp: "2023-12-06T05:54:14Z"
+ message: Compliant; notification - customresourcedefinitions [policyreports.wgpolicyk8s.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285334bd6234
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - customresourcedefinitions [updaterequests.kyverno.io]
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e28588a2bd302
+ lastTimestamp: "2023-12-06T05:54:29Z"
+ message: Compliant; notification - deployments [kyverno] in namespace kyverno found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2851d0e23da9
+ lastTimestamp: "2023-12-06T05:54:01Z"
+ message: Compliant; notification - namespaces [kyverno] found as specified, therefore
+ this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2853398624f1
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - roles [kyverno:leaderelection] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2858b1db4b8e
+ lastTimestamp: "2023-12-06T05:54:30Z"
+ message: Compliant; notification - rolebindings [kyverno:leaderelection] in namespace
+ kyverno found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2857bc2aa4bd
+ lastTimestamp: "2023-12-06T05:54:26Z"
+ message: Compliant; notification - services [kyverno-svc-metrics] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e285346ad8e3c
+ lastTimestamp: "2023-12-06T05:54:07Z"
+ message: Compliant; notification - services [kyverno-svc] in namespace kyverno found
+ as specified, therefore this Object template is compliant
+ - eventName: c2p.policy-install-kyverno-from-manifests.179e2857c388cf77
+ lastTimestamp: "2023-12-06T05:54:26Z"
+ message: Compliant; notification - serviceaccounts [kyverno] in namespace kyverno
+ found as specified, therefore this Object template is compliant
+
+ ```
+Details
+
+ - Subject UUID: 6fade0d6-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster1
+ - Result: fail
+ - Reason:
+ ```
+ - eventName: c2p.policy-kyverno-require-labels.179e2851c11fe04c
+ lastTimestamp: "2023-12-06T05:54:00Z"
+ message: Compliant; notification - clusterpolicies [require-labels] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-kyverno-require-labels.179e2862688eaee7
+ lastTimestamp: "2023-12-06T05:55:12Z"
+ message: 'NonCompliant; violation - policyreports found: [cpol-require-labels] in
+ namespace local-path-storage'
+
+ ```
+
+ - Subject UUID: 6fade374-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster2
+ - Result: fail
+ - Reason:
+ ```
+ - eventName: c2p.policy-kyverno-require-labels.179e2855f5ab92dd
+ lastTimestamp: "2023-12-06T05:54:18Z"
+ message: Compliant; notification - clusterpolicies [require-labels] found as specified,
+ therefore this Object template is compliant
+ - eventName: c2p.policy-kyverno-require-labels.179e2862e1802d28
+ lastTimestamp: "2023-12-06T05:55:14Z"
+ message: 'NonCompliant; violation - policyreports found: [cpol-require-labels] in
+ namespace local-path-storage'
+
+ ```
+Details
+
+ - Subject UUID: 6fade0d6-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster1
+ - Result: fail
+ - Reason:
+ ```
+ - eventName: c2p.policy-deployment.179e284f776397b3
+ lastTimestamp: "2023-12-06T05:53:50Z"
+ message: 'NonCompliant; violation - deployments not found: [nginx-deployment] in
+ namespace cluster1 missing; [nginx-deployment] in namespace default missing; [nginx-deployment]
+ in namespace kube-node-lease missing; [nginx-deployment] in namespace kube-public
+ missing; [nginx-deployment] in namespace kyverno missing; [nginx-deployment] in
+ namespace local-path-storage missing'
+
+ ```
+
+ - Subject UUID: 6fade374-93fc-11ee-a029-62f79297f1b7
+ - Title: Cluster Name: cluster2
+ - Result: fail
+ - Reason:
+ ```
+ - eventName: c2p.policy-deployment.179e2854bed6d22e
+ lastTimestamp: "2023-12-06T05:54:13Z"
+ message: 'NonCompliant; violation - deployments not found: [nginx-deployment] in
+ namespace cluster2 missing; [nginx-deployment] in namespace default missing; [nginx-deployment]
+ in namespace kube-node-lease missing; [nginx-deployment] in namespace kube-public
+ missing; [nginx-deployment] in namespace kyverno missing; [nginx-deployment] in
+ namespace local-path-storage missing'
+
+ ```
+