Repository: aquasecurity/starboard
Pull request #890 (2022-01-07 17:26:23)

refactor: rename kube.Object to kube.ObjectRef
There is no good moment for such refactoring but I found
kube.Object pretty confusing with ubiquitous client.Object
defined by the controller-runtime module. We use both
types throughout the code in the same source files
so this patch renames kube.Object to kube.ObjectRef.

Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#890](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (ff0b080) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/53b6ca8eeb3af29b56e396884b2423000c4be942?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (53b6ca8) will **decrease** coverage by `19.54%`.
> The diff coverage is `36.53%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/890/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #890       +/-   ##
===========================================
- Coverage   65.68%   46.13%   -19.55%     
===========================================
  Files          58       41       -17     
  Lines        6513     5330     -1183     
===========================================
- Hits         4278     2459     -1819     
- Misses       1801     2720      +919     
+ Partials      434      151      -283     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-56.39%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-57.65%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-65.89%)` | :arrow_down: |
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-62.50%)` | :arrow_down: |
| [pkg/report/html.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3JlcG9ydC9odG1sLmdv) | `18.71% <0.00%> (ø)` | |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-60.40%)` | :arrow_down: |
| [pkg/vulnerabilityreport/io.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvaW8uZ28=) | `55.17% <50.00%> (-17.25%)` | :arrow_down: |
| [pkg/configauditreport/io.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L2lvLmdv) | `65.47% <66.66%> (-1.20%)` | :arrow_down: |
| [pkg/kube/object.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvb2JqZWN0Lmdv) | `50.57% <75.00%> (-9.95%)` | :arrow_down: |
| [itest/matcher/matcher.go](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-aXRlc3QvbWF0Y2hlci9tYXRjaGVyLmdv) | `74.16% <100.00%> (ø)` | |
| ... and [43 more](https://codecov.io/gh/aquasecurity/starboard/pull/890/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [53b6ca8...ff0b080](https://codecov.io/gh/aquasecurity/starboard/pull/890?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/pkg/cmd/commands.go b/pkg/cmd/commands.go
index 932c5ab..03fa6de 100644
--- a/pkg/cmd/commands.go
+++ b/pkg/cmd/commands.go
@@ -20,7 +20,7 @@ func SetGlobalFlags(cf *genericclioptions.ConfigFlags, cmd *cobra.Command) {
 	}
 }
 
-func WorkloadFromArgs(mapper meta.RESTMapper, namespace string, args []string) (workload kube.Object, gvk schema.GroupVersionKind, err error) {
+func WorkloadFromArgs(mapper meta.RESTMapper, namespace string, args []string) (workload kube.ObjectRef, gvk schema.GroupVersionKind, err error) {
 	if len(args) < 1 {
 		err = errors.New("required workload kind and name not specified")
 		return
@@ -44,7 +44,7 @@ func WorkloadFromArgs(mapper meta.RESTMapper, namespace string, args []string) (
 		err = errors.New("required workload name is blank")
 		return
 	}
-	workload = kube.Object{
+	workload = kube.ObjectRef{
 		Namespace: namespace,
 		Kind:      kube.Kind(gvk.Kind),
 		Name:      resourceName,
diff --git a/pkg/configauditreport/builder.go b/pkg/configauditreport/builder.go
index a6cda7c..579f013 100644
--- a/pkg/configauditreport/builder.go
+++ b/pkg/configauditreport/builder.go
@@ -132,7 +132,7 @@ func (s *ScanJobBuilder) Get() (*batchv1.Job, []*corev1.Secret, error) {
 }
 
 func GetScanJobName(obj client.Object) string {
-	return fmt.Sprintf("scan-configauditreport-%s", kube.ComputeHash(kube.Object{
+	return fmt.Sprintf("scan-configauditreport-%s", kube.ComputeHash(kube.ObjectRef{
 		Kind:      kube.Kind(obj.GetObjectKind().GroupVersionKind().Kind),
 		Namespace: obj.GetNamespace(),
 		Name:      obj.GetName(),
diff --git a/pkg/configauditreport/io.go b/pkg/configauditreport/io.go
index d4dd092..cb173ce 100644
--- a/pkg/configauditreport/io.go
+++ b/pkg/configauditreport/io.go
@@ -28,18 +28,18 @@ type Writer interface {
 type Reader interface {
 
 	// FindReportByOwner returns a v1alpha1.ConfigAuditReport owned by the given
-	// kube.Object or nil if the report is not found.
-	FindReportByOwner(ctx context.Context, owner kube.Object) (*v1alpha1.ConfigAuditReport, error)
+	// kube.ObjectRef or nil if the report is not found.
+	FindReportByOwner(ctx context.Context, owner kube.ObjectRef) (*v1alpha1.ConfigAuditReport, error)
 
-	// FindReportByOwnerInHierarchy is similar to FindReportByOwner except that it tries to lookup
+	// FindReportByOwnerInHierarchy is similar to FindReportByOwner except that it tries to find
 	// a v1alpha1.ConfigAuditReport object owned by related Kubernetes objects.
 	// For example, if the given owner is a Deployment, but a report is owned by the
 	// active ReplicaSet (current revision) this method will return the report.
-	FindReportByOwnerInHierarchy(ctx context.Context, owner kube.Object) (*v1alpha1.ConfigAuditReport, error)
+	FindReportByOwnerInHierarchy(ctx context.Context, owner kube.ObjectRef) (*v1alpha1.ConfigAuditReport, error)
 
 	// FindClusterReportByOwner returns a v1alpha1.ClusterConfigAuditReport owned by the given
-	// kube.Object or nil if the report is not found.
-	FindClusterReportByOwner(ctx context.Context, owner kube.Object) (*v1alpha1.ClusterConfigAuditReport, error)
+	// kube.ObjectRef or nil if the report is not found.
+	FindClusterReportByOwner(ctx context.Context, owner kube.ObjectRef) (*v1alpha1.ClusterConfigAuditReport, error)
 }
 
 type ReadWriter interface {
@@ -103,10 +103,10 @@ func (r *readWriter) WriteClusterReport(ctx context.Context, report v1alpha1.Clu
 	return err
 }
 
-func (r *readWriter) FindReportByOwner(ctx context.Context, owner kube.Object) (*v1alpha1.ConfigAuditReport, error) {
+func (r *readWriter) FindReportByOwner(ctx context.Context, owner kube.ObjectRef) (*v1alpha1.ConfigAuditReport, error) {
 	var list v1alpha1.ConfigAuditReportList
 
-	labels := client.MatchingLabels(kube.PartialObjectToLabels(owner))
+	labels := client.MatchingLabels(kube.ObjectRefToLabels(owner))
 
 	err := r.List(ctx, &list, labels, client.InNamespace(owner.Namespace))
 	if err != nil {
@@ -120,7 +120,7 @@ func (r *readWriter) FindReportByOwner(ctx context.Context, owner kube.Object) (
 	return nil, nil
 }
 
-func (r *readWriter) FindReportByOwnerInHierarchy(ctx context.Context, owner kube.Object) (*v1alpha1.ConfigAuditReport, error) {
+func (r *readWriter) FindReportByOwnerInHierarchy(ctx context.Context, owner kube.ObjectRef) (*v1alpha1.ConfigAuditReport, error) {
 	report, err := r.FindReportByOwner(ctx, owner)
 	if err != nil {
 		return nil, err
@@ -132,7 +132,7 @@ func (r *readWriter) FindReportByOwnerInHierarchy(ctx context.Context, owner kub
 		if err != nil {
 			return nil, fmt.Errorf("getting replicaset related to %s/%s: %w", owner.Kind, owner.Name, err)
 		}
-		report, err = r.FindReportByOwner(ctx, kube.Object{
+		report, err = r.FindReportByOwner(ctx, kube.ObjectRef{
 			Kind:      kube.KindReplicaSet,
 			Name:      rsName,
 			Namespace: owner.Namespace,
@@ -146,10 +146,10 @@ func (r *readWriter) FindReportByOwnerInHierarchy(ctx context.Context, owner kub
 	return nil, nil
 }
 
-func (r *readWriter) FindClusterReportByOwner(ctx context.Context, owner kube.Object) (*v1alpha1.ClusterConfigAuditReport, error) {
+func (r *readWriter) FindClusterReportByOwner(ctx context.Context, owner kube.ObjectRef) (*v1alpha1.ClusterConfigAuditReport, error) {
 	var list v1alpha1.ClusterConfigAuditReportList
 
-	labels := client.MatchingLabels(kube.PartialObjectToLabels(owner))
+	labels := client.MatchingLabels(kube.ObjectRefToLabels(owner))
 
 	err := r.List(ctx, &list, labels)
 	if err != nil {
diff --git a/pkg/configauditreport/scanner.go b/pkg/configauditreport/scanner.go
index 82ed502..b9d81ca 100644
--- a/pkg/configauditreport/scanner.go
+++ b/pkg/configauditreport/scanner.go
@@ -45,11 +45,11 @@ func NewScanner(
 	}
 }
 
-func (s *Scanner) Scan(ctx context.Context, partial kube.Object) (*ReportBuilder, error) {
+func (s *Scanner) Scan(ctx context.Context, partial kube.ObjectRef) (*ReportBuilder, error) {
 	if !s.supportsKind(partial.Kind) {
 		return nil, fmt.Errorf("kind %s is not supported by %s plugin", partial.Kind, s.pluginContext.GetName())
 	}
-	obj, err := s.objectResolver.GetObjectFromPartialObject(ctx, partial)
+	obj, err := s.objectResolver.ObjectFromObjectRef(ctx, partial)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/kube/object.go b/pkg/kube/object.go
index 7741b3e..37aa3f9 100644
--- a/pkg/kube/object.go
+++ b/pkg/kube/object.go
@@ -25,17 +25,16 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 )
 
-// TODO Rename from Object to PartialObject (consider embedding types.NamespacedName struct)
-// Object is a simplified representation of a Kubernetes object.
-// Each object has kind, which designates the type of the entity it represents.
+// ObjectRef is a simplified representation of a Kubernetes client.Object.
+// Each object has Kind, which designates the type of the entity it represents.
 // Objects have names and many of them live in namespaces.
-type Object struct {
+type ObjectRef struct {
 	Kind      Kind
 	Name      string
 	Namespace string
 }
 
-// Kind represents the type of a Kubernetes Object.
+// Kind represents the type of Kubernetes client.Object.
 type Kind string
 
 const (
@@ -83,13 +82,13 @@ func IsClusterScopedKind(k string) bool {
 	}
 }
 
-// PartialObjectToLabels encodes the specified Object as a set of labels.
+// ObjectRefToLabels encodes the specified ObjectRef as a set of labels.
 //
 // If Object's name cannot be used as the value of the
 // starboard.LabelResourceName label, as a fallback, this method will calculate
 // a hash of the Object's name and use it as the value of the
 // starboard.LabelResourceNameHash label.
-func PartialObjectToLabels(obj Object) map[string]string {
+func ObjectRefToLabels(obj ObjectRef) map[string]string {
 	labels := map[string]string{
 		starboard.LabelResourceKind:      string(obj.Kind),
 		starboard.LabelResourceNamespace: obj.Namespace,
@@ -122,21 +121,21 @@ func ObjectToObjectMetadata(obj client.Object, meta *metav1.ObjectMeta) error {
 	return nil
 }
 
-func PartialObjectFromObjectMetadata(objectMeta metav1.ObjectMeta) (Object, error) {
+func ObjectRefFromObjectMeta(objectMeta metav1.ObjectMeta) (ObjectRef, error) {
 	if _, found := objectMeta.Labels[starboard.LabelResourceKind]; !found {
-		return Object{}, fmt.Errorf("required label does not exist: %s", starboard.LabelResourceKind)
+		return ObjectRef{}, fmt.Errorf("required label does not exist: %s", starboard.LabelResourceKind)
 	}
 	var objname string
 	if _, found := objectMeta.Labels[starboard.LabelResourceName]; !found {
 		if _, found := objectMeta.Annotations[starboard.LabelResourceName]; found {
 			objname = objectMeta.Annotations[starboard.LabelResourceName]
 		} else {
-			return Object{}, fmt.Errorf("required label does not exist: %s", starboard.LabelResourceName)
+			return ObjectRef{}, fmt.Errorf("required label does not exist: %s", starboard.LabelResourceName)
 		}
 	} else {
 		objname = objectMeta.Labels[starboard.LabelResourceName]
 	}
-	return Object{
+	return ObjectRef{
 		Kind:      Kind(objectMeta.Labels[starboard.LabelResourceKind]),
 		Name:      objname,
 		Namespace: objectMeta.Labels[starboard.LabelResourceNamespace],
@@ -188,8 +187,8 @@ func KindForObject(object metav1.Object, scheme *runtime.Scheme) (string, error)
 	return gvk.Kind, nil
 }
 
-func GetPartialObjectFromKindAndNamespacedName(kind Kind, name types.NamespacedName) Object {
-	return Object{
+func ObjectRefFromKindAndNamespacedName(kind Kind, name types.NamespacedName) ObjectRef {
+	return ObjectRef{
 		Kind:      kind,
 		Name:      name.Name,
 		Namespace: name.Namespace,
@@ -257,7 +256,7 @@ type ObjectResolver struct {
 	client.Client
 }
 
-func (o *ObjectResolver) GetObjectFromPartialObject(ctx context.Context, workload Object) (client.Object, error) {
+func (o *ObjectResolver) ObjectFromObjectRef(ctx context.Context, workload ObjectRef) (client.Object, error) {
 	var obj client.Object
 	switch workload.Kind {
 	case KindPod:
@@ -436,7 +435,7 @@ func (o *ObjectResolver) ensureGVK(obj client.Object) (client.Object, error) {
 // the given owner. If the owner is a Deployment, it will look for a ReplicaSet
 // that is controlled by the Deployment. If the owner is a Pod, it will look for
 // the ReplicaSet that owns the Pod.
-func (o *ObjectResolver) GetRelatedReplicasetName(ctx context.Context, object Object) (string, error) {
+func (o *ObjectResolver) GetRelatedReplicasetName(ctx context.Context, object ObjectRef) (string, error) {
 	switch object.Kind {
 	case KindDeployment:
 		return o.getActiveReplicaSetByDeployment(ctx, object)
@@ -446,7 +445,7 @@ func (o *ObjectResolver) GetRelatedReplicasetName(ctx context.Context, object Ob
 	return "", fmt.Errorf("can only get related ReplicaSet for Deployment or Pod, not %q", string(object.Kind))
 }
 
-func (o *ObjectResolver) getActiveReplicaSetByDeployment(ctx context.Context, object Object) (string, error) {
+func (o *ObjectResolver) getActiveReplicaSetByDeployment(ctx context.Context, object ObjectRef) (string, error) {
 	deploy := &appsv1.Deployment{}
 	err := o.Client.Get(ctx, types.NamespacedName{Namespace: object.Namespace, Name: object.Name}, deploy)
 	if err != nil {
@@ -465,8 +464,7 @@ func (o *ObjectResolver) getActiveReplicaSetByDeployment(ctx context.Context, ob
 		return "", fmt.Errorf("no replicasets associated with deployment %q", object.Name)
 	}
 	for _, rs := range rsList.Items {
-		if deploy.Annotations["deployment.kubernetes.io/revision"] !=
-			rs.Annotations["deployment.kubernetes.io/revision"] {
+		if deploy.Annotations[deploymentAnnotation] != rs.Annotations[deploymentAnnotation] {
 			continue
 		}
 		return rs.Name, nil
@@ -474,7 +472,7 @@ func (o *ObjectResolver) getActiveReplicaSetByDeployment(ctx context.Context, ob
 	return "", fmt.Errorf("did not find an active replicaset associated with deployment %q", object.Name)
 }
 
-func (o *ObjectResolver) getReplicaSetByPod(ctx context.Context, object Object) (string, error) {
+func (o *ObjectResolver) getReplicaSetByPod(ctx context.Context, object ObjectRef) (string, error) {
 	pod := &corev1.Pod{}
 	err := o.Client.Get(ctx, types.NamespacedName{Namespace: object.Namespace, Name: object.Name}, pod)
 	if err != nil {
diff --git a/pkg/kubebench/io.go b/pkg/kubebench/io.go
index c8abdcc..bd37a67 100644
--- a/pkg/kubebench/io.go
+++ b/pkg/kubebench/io.go
@@ -15,7 +15,7 @@ type Writer interface {
 }
 
 type Reader interface {
-	FindByOwner(ctx context.Context, node kube.Object) (*v1alpha1.CISKubeBenchReport, error)
+	FindByOwner(ctx context.Context, node kube.ObjectRef) (*v1alpha1.CISKubeBenchReport, error)
 }
 
 type ReadWriter interface {
@@ -55,7 +55,7 @@ func (w *rw) Write(ctx context.Context, report v1alpha1.CISKubeBenchReport) erro
 	return err
 }
 
-func (w *rw) FindByOwner(ctx context.Context, node kube.Object) (*v1alpha1.CISKubeBenchReport, error) {
+func (w *rw) FindByOwner(ctx context.Context, node kube.ObjectRef) (*v1alpha1.CISKubeBenchReport, error) {
 	report := &v1alpha1.CISKubeBenchReport{}
 	err := w.client.Get(ctx, types.NamespacedName{
 		Name: node.Name,
diff --git a/pkg/operator/controller/ciskubebenchreport.go b/pkg/operator/controller/ciskubebenchreport.go
index 63cde85..d030b0e 100644
--- a/pkg/operator/controller/ciskubebenchreport.go
+++ b/pkg/operator/controller/ciskubebenchreport.go
@@ -130,7 +130,7 @@ func (r *CISKubeBenchReportReconciler) reconcileNodes() reconcile.Func {
 }
 
 func (r *CISKubeBenchReportReconciler) hasReport(ctx context.Context, node *corev1.Node) (bool, error) {
-	report, err := r.ReadWriter.FindByOwner(ctx, kube.Object{Kind: kube.KindNode, Name: node.Name})
+	report, err := r.ReadWriter.FindByOwner(ctx, kube.ObjectRef{Kind: kube.KindNode, Name: node.Name})
 	if err != nil {
 		return false, err
 	}
@@ -240,7 +240,7 @@ func (r *CISKubeBenchReportReconciler) reconcileJobs() reconcile.Func {
 func (r *CISKubeBenchReportReconciler) processCompleteScanJob(ctx context.Context, job *batchv1.Job) error {
 	log := r.Logger.WithValues("job", fmt.Sprintf("%s/%s", job.Namespace, job.Name))
 
-	nodeRef, err := kube.PartialObjectFromObjectMetadata(job.ObjectMeta)
+	nodeRef, err := kube.ObjectRefFromObjectMeta(job.ObjectMeta)
 	if err != nil {
 		return fmt.Errorf("getting owner ref from scan job metadata: %w", err)
 	}
diff --git a/pkg/operator/controller/configauditreport.go b/pkg/operator/controller/configauditreport.go
index d5a0e59..fdc5af3 100644
--- a/pkg/operator/controller/configauditreport.go
+++ b/pkg/operator/controller/configauditreport.go
@@ -133,10 +133,10 @@ func (r *ConfigAuditReportReconciler) reconcileResource(resourceKind kube.Kind)
 	return func(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 		log := r.Logger.WithValues("kind", resourceKind, "name", req.NamespacedName)
 
-		resourcePartial := kube.GetPartialObjectFromKindAndNamespacedName(resourceKind, req.NamespacedName)
+		resourcePartial := kube.ObjectRefFromKindAndNamespacedName(resourceKind, req.NamespacedName)
 
 		log.V(1).Info("Getting resource from cache")
-		resource, err := r.GetObjectFromPartialObject(ctx, resourcePartial)
+		resource, err := r.ObjectFromObjectRef(ctx, resourcePartial)
 		if err != nil {
 			if errors.IsNotFound(err) {
 				log.V(1).Info("Ignoring cached resource that must have been deleted")
@@ -286,7 +286,7 @@ func (r *ConfigAuditReportReconciler) reconcileResource(resourceKind kube.Kind)
 	}
 }
 
-func (r *ConfigAuditReportReconciler) hasReport(ctx context.Context, owner kube.Object, podSpecHash string, pluginConfigHash string) (bool, error) {
+func (r *ConfigAuditReportReconciler) hasReport(ctx context.Context, owner kube.ObjectRef, podSpecHash string, pluginConfigHash string) (bool, error) {
 	if kube.IsClusterScopedKind(string(owner.Kind)) {
 		return r.hasClusterReport(ctx, owner, podSpecHash, pluginConfigHash)
 	}
@@ -302,7 +302,7 @@ func (r *ConfigAuditReportReconciler) hasReport(ctx context.Context, owner kube.
 	return false, nil
 }
 
-func (r *ConfigAuditReportReconciler) hasClusterReport(ctx context.Context, owner kube.Object, podSpecHash string, pluginConfigHash string) (bool, error) {
+func (r *ConfigAuditReportReconciler) hasClusterReport(ctx context.Context, owner kube.ObjectRef, podSpecHash string, pluginConfigHash string) (bool, error) {
 	report, err := r.ReadWriter.FindClusterReportByOwner(ctx, owner)
 	if err != nil {
 		return false, err
@@ -367,18 +367,18 @@ func (r *ConfigAuditReportReconciler) reconcileJobs() reconcile.Func {
 func (r *ConfigAuditReportReconciler) processCompleteScanJob(ctx context.Context, job *batchv1.Job) error {
 	log := r.Logger.WithValues("job", fmt.Sprintf("%s/%s", job.Namespace, job.Name))
 
-	ownerRef, err := kube.PartialObjectFromObjectMetadata(job.ObjectMeta)
+	ownerRef, err := kube.ObjectRefFromObjectMeta(job.ObjectMeta)
 	if err != nil {
 		return fmt.Errorf("getting owner ref from scan job metadata: %w", err)
 	}
 
-	owner, err := r.GetObjectFromPartialObject(ctx, ownerRef)
+	owner, err := r.ObjectFromObjectRef(ctx, ownerRef)
 	if err != nil {
 		if errors.IsNotFound(err) {
 			log.V(1).Info("Report owner must have been deleted", "owner", owner)
 			return r.deleteJob(ctx, job)
 		}
-		return fmt.Errorf("getting object from partial object: %w", err)
+		return fmt.Errorf("getting object from object ref: %w", err)
 	}
 
 	resourceSpecHash, ok := job.Labels[starboard.LabelResourceSpecHash]
diff --git a/pkg/operator/controller/vulnerabilityreport.go b/pkg/operator/controller/vulnerabilityreport.go
index 1ec65a0..5e18d88 100644
--- a/pkg/operator/controller/vulnerabilityreport.go
+++ b/pkg/operator/controller/vulnerabilityreport.go
@@ -87,10 +87,10 @@ func (r *VulnerabilityReportReconciler) reconcileWorkload(workloadKind kube.Kind
 	return func(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 		log := r.Logger.WithValues("kind", workloadKind, "name", req.NamespacedName)
 
-		workloadPartial := kube.GetPartialObjectFromKindAndNamespacedName(workloadKind, req.NamespacedName)
+		workloadPartial := kube.ObjectRefFromKindAndNamespacedName(workloadKind, req.NamespacedName)
 
 		log.V(1).Info("Getting workload from cache")
-		workloadObj, err := r.GetObjectFromPartialObject(ctx, workloadPartial)
+		workloadObj, err := r.ObjectFromObjectRef(ctx, workloadPartial)
 		if err != nil {
 			if errors.IsNotFound(err) {
 				log.V(1).Info("Ignoring cached workload that must have been deleted")
@@ -176,7 +176,7 @@ func (r *VulnerabilityReportReconciler) reconcileWorkload(workloadKind kube.Kind
 	}
 }
 
-func (r *VulnerabilityReportReconciler) hasReports(ctx context.Context, owner kube.Object, hash string, images kube.ContainerImages) (bool, error) {
+func (r *VulnerabilityReportReconciler) hasReports(ctx context.Context, owner kube.ObjectRef, hash string, images kube.ContainerImages) (bool, error) {
 	// TODO FindByOwner should accept optional label selector to further narrow down search results
 	list, err := r.FindByOwner(ctx, owner)
 	if err != nil {
@@ -200,7 +200,7 @@ func (r *VulnerabilityReportReconciler) hasReports(ctx context.Context, owner ku
 	return reflect.DeepEqual(actual, expected), nil
 }
 
-func (r *VulnerabilityReportReconciler) hasActiveScanJob(ctx context.Context, owner kube.Object, hash string) (bool, *batchv1.Job, error) {
+func (r *VulnerabilityReportReconciler) hasActiveScanJob(ctx context.Context, owner kube.ObjectRef, hash string) (bool, *batchv1.Job, error) {
 	jobName := fmt.Sprintf("scan-vulnerabilityreport-%s", kube.ComputeHash(owner))
 	job := &batchv1.Job{}
 	err := r.Get(ctx, client.ObjectKey{Namespace: r.Config.Namespace, Name: jobName}, job)
@@ -312,18 +312,18 @@ func (r *VulnerabilityReportReconciler) reconcileJobs() reconcile.Func {
 func (r *VulnerabilityReportReconciler) processCompleteScanJob(ctx context.Context, job *batchv1.Job) error {
 	log := r.Logger.WithValues("job", fmt.Sprintf("%s/%s", job.Namespace, job.Name))
 
-	ownerRef, err := kube.PartialObjectFromObjectMetadata(job.ObjectMeta)
+	ownerRef, err := kube.ObjectRefFromObjectMeta(job.ObjectMeta)
 	if err != nil {
 		return fmt.Errorf("getting owner ref from scan job metadata: %w", err)
 	}
 
-	owner, err := r.GetObjectFromPartialObject(ctx, ownerRef)
+	owner, err := r.ObjectFromObjectRef(ctx, ownerRef)
 	if err != nil {
 		if errors.IsNotFound(err) {
 			log.V(1).Info("Report owner must have been deleted", "owner", owner)
 			return r.deleteJob(ctx, job)
 		}
-		return fmt.Errorf("getting object from partial object: %w", err)
+		return fmt.Errorf("getting object from object ref: %w", err)
 	}
 
 	containerImages, err := kube.GetContainerImagesFromJob(job)
diff --git a/pkg/report/html.go b/pkg/report/html.go
index 4d388f2..74c9729 100644
--- a/pkg/report/html.go
+++ b/pkg/report/html.go
@@ -32,7 +32,7 @@ func NewWorkloadReporter(clock ext.Clock, client client.Client) WorkloadReporter
 	}
 }
 
-func (h *workloadReporter) RetrieveData(workload kube.Object) (templates.WorkloadReport, error) {
+func (h *workloadReporter) RetrieveData(workload kube.ObjectRef) (templates.WorkloadReport, error) {
 	ctx := context.Background()
 	configAuditReport, err := h.configAuditReportsReader.FindReportByOwnerInHierarchy(ctx, workload)
 	if err != nil {
@@ -66,7 +66,7 @@ func (h *workloadReporter) RetrieveData(workload kube.Object) (templates.Workloa
 	}, nil
 }
 
-func (h *workloadReporter) Generate(workload kube.Object, writer io.Writer) error {
+func (h *workloadReporter) Generate(workload kube.ObjectRef, writer io.Writer) error {
 	data, err := h.RetrieveData(workload)
 	if err != nil {
 		return err
@@ -88,7 +88,7 @@ func NewNamespaceReporter(clock ext.Clock, client client.Client) NamespaceReport
 	}
 }
 
-func (r *namespaceReporter) RetrieveData(namespace kube.Object) (templates.NamespaceReport, error) {
+func (r *namespaceReporter) RetrieveData(namespace kube.ObjectRef) (templates.NamespaceReport, error) {
 	var vulnerabilityReportList v1alpha1.VulnerabilityReportList
 	err := r.client.List(context.Background(), &vulnerabilityReportList, client.InNamespace(namespace.Name))
 	if err != nil {
@@ -229,7 +229,7 @@ func (r *namespaceReporter) topNVulnerabilitiesByScore(reports []v1alpha1.Vulner
 	return vulnerabilities[:ext.MinInt(N, len(vulnerabilities))]
 }
 
-func (r *namespaceReporter) Generate(namespace kube.Object, out io.Writer) error {
+func (r *namespaceReporter) Generate(namespace kube.ObjectRef, out io.Writer) error {
 	data, err := r.RetrieveData(namespace)
 	if err != nil {
 		return err
@@ -253,7 +253,7 @@ func NewNodeReporter(clock ext.Clock, client client.Client) NodeReporter {
 	}
 }
 
-func (r *nodeReporter) Generate(node kube.Object, out io.Writer) error {
+func (r *nodeReporter) Generate(node kube.ObjectRef, out io.Writer) error {
 	data, err := r.RetrieveData(node)
 	if err != nil {
 		return err
@@ -262,7 +262,7 @@ func (r *nodeReporter) Generate(node kube.Object, out io.Writer) error {
 	return nil
 }
 
-func (r *nodeReporter) RetrieveData(node kube.Object) (templates.NodeReport, error) {
+func (r *nodeReporter) RetrieveData(node kube.ObjectRef) (templates.NodeReport, error) {
 	found := &v1alpha1.CISKubeBenchReport{}
 	err := r.client.Get(context.Background(), types.NamespacedName{Name: node.Name}, found)
 	if err != nil {
diff --git a/pkg/report/report.go b/pkg/report/report.go
index cce6e31..651a38a 100644
--- a/pkg/report/report.go
+++ b/pkg/report/report.go
@@ -8,16 +8,16 @@ import (
 )
 
 type WorkloadReporter interface {
-	RetrieveData(workload kube.Object) (templates.WorkloadReport, error)
-	Generate(workload kube.Object, out io.Writer) error
+	RetrieveData(workload kube.ObjectRef) (templates.WorkloadReport, error)
+	Generate(workload kube.ObjectRef, out io.Writer) error
 }
 
 type NamespaceReporter interface {
-	RetrieveData(namespace kube.Object) (templates.NamespaceReport, error)
-	Generate(namespace kube.Object, out io.Writer) error
+	RetrieveData(namespace kube.ObjectRef) (templates.NamespaceReport, error)
+	Generate(namespace kube.ObjectRef, out io.Writer) error
 }
 
 type NodeReporter interface {
-	RetrieveData(node kube.Object) (templates.NodeReport, error)
-	Generate(node kube.Object, out io.Writer) error
+	RetrieveData(node kube.ObjectRef) (templates.NodeReport, error)
+	Generate(node kube.ObjectRef, out io.Writer) error
 }
diff --git a/pkg/report/templates/types.go b/pkg/report/templates/types.go
index 967a271..27d73f0 100644
--- a/pkg/report/templates/types.go
+++ b/pkg/report/templates/types.go
@@ -10,7 +10,7 @@ import (
 // WorkloadReport is a structure that holds data to render
 // an HTML report for a specified K8s workload.
 type WorkloadReport struct {
-	Workload    kube.Object
+	Workload    kube.ObjectRef
 	GeneratedAt time.Time
 
 	// FIXME Do not use map as the order of iteration is unpredictable.
@@ -21,7 +21,7 @@ type WorkloadReport struct {
 // NamespaceReport is a structure that holds data to render
 // an HTML report for a specified K8s namespace.
 type NamespaceReport struct {
-	Namespace   kube.Object
+	Namespace   kube.ObjectRef
 	GeneratedAt time.Time
 
 	Top5VulnerableImages []v1alpha1.VulnerabilityReport
@@ -42,7 +42,7 @@ type CheckWithCount struct {
 // NodeReport is a structure that holds data to render
 // an HTML report for a specified K8s node.
 type NodeReport struct {
-	Node        kube.Object
+	Node        kube.ObjectRef
 	GeneratedAt time.Time
 
 	CisKubeBenchReport *v1alpha1.CISKubeBenchReport
diff --git a/pkg/vulnerabilityreport/builder.go b/pkg/vulnerabilityreport/builder.go
index 786b817..7e9cbe1 100644
--- a/pkg/vulnerabilityreport/builder.go
+++ b/pkg/vulnerabilityreport/builder.go
@@ -130,7 +130,7 @@ func (s *ScanJobBuilder) Get() (*batchv1.Job, []*corev1.Secret, error) {
 }
 
 func GetScanJobName(obj client.Object) string {
-	return fmt.Sprintf("scan-vulnerabilityreport-%s", kube.ComputeHash(kube.Object{
+	return fmt.Sprintf("scan-vulnerabilityreport-%s", kube.ComputeHash(kube.ObjectRef{
 		Kind:      kube.Kind(obj.GetObjectKind().GroupVersionKind().Kind),
 		Namespace: obj.GetNamespace(),
 		Name:      obj.GetName(),
diff --git a/pkg/vulnerabilityreport/io.go b/pkg/vulnerabilityreport/io.go
index 222894a..68175f4 100644
--- a/pkg/vulnerabilityreport/io.go
+++ b/pkg/vulnerabilityreport/io.go
@@ -22,15 +22,15 @@ type Writer interface {
 // Reader is the interface that wraps methods for finding v1alpha1.VulnerabilityReport objects.
 //
 // FindByOwner returns the slice of v1alpha1.VulnerabilityReport instances
-// owned by the given kube.Object or an empty slice if the reports are not found.
+// owned by the given kube.ObjectRef or an empty slice if the reports are not found.
 //
 // FindByOwnerInHierarchy is similar to FindByOwner except it tries to lookup
 // v1alpha1.VulnerabilityReport objects owned by related Kubernetes objects.
 // For example, if the given owner is a Deployment, but reports are owned by the
 // active ReplicaSet (current revision) this method will return the reports.
 type Reader interface {
-	FindByOwner(context.Context, kube.Object) ([]v1alpha1.VulnerabilityReport, error)
-	FindByOwnerInHierarchy(ctx context.Context, object kube.Object) ([]v1alpha1.VulnerabilityReport, error)
+	FindByOwner(context.Context, kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error)
+	FindByOwnerInHierarchy(ctx context.Context, object kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error)
 }
 
 type ReadWriter interface {
@@ -83,10 +83,10 @@ func (r *readWriter) createOrUpdate(ctx context.Context, report v1alpha1.Vulnera
 	return err
 }
 
-func (r *readWriter) FindByOwner(ctx context.Context, owner kube.Object) ([]v1alpha1.VulnerabilityReport, error) {
+func (r *readWriter) FindByOwner(ctx context.Context, owner kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error) {
 	var list v1alpha1.VulnerabilityReportList
 
-	labels := client.MatchingLabels(kube.PartialObjectToLabels(owner))
+	labels := client.MatchingLabels(kube.ObjectRefToLabels(owner))
 
 	err := r.List(ctx, &list, labels, client.InNamespace(owner.Namespace))
 	if err != nil {
@@ -96,7 +96,7 @@ func (r *readWriter) FindByOwner(ctx context.Context, owner kube.Object) ([]v1al
 	return list.DeepCopy().Items, nil
 }
 
-func (r *readWriter) FindByOwnerInHierarchy(ctx context.Context, owner kube.Object) ([]v1alpha1.VulnerabilityReport, error) {
+func (r *readWriter) FindByOwnerInHierarchy(ctx context.Context, owner kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error) {
 	reports, err := r.FindByOwner(ctx, owner)
 	if err != nil {
 		return nil, err
@@ -108,7 +108,7 @@ func (r *readWriter) FindByOwnerInHierarchy(ctx context.Context, owner kube.Obje
 		if err != nil {
 			return nil, fmt.Errorf("getting replicaset related to %s/%s: %w", owner.Kind, owner.Name, err)
 		}
-		reports, err = r.FindByOwner(ctx, kube.Object{
+		reports, err = r.FindByOwner(ctx, kube.ObjectRef{
 			Kind:      kube.KindReplicaSet,
 			Name:      rsName,
 			Namespace: owner.Namespace,
diff --git a/pkg/vulnerabilityreport/scanner.go b/pkg/vulnerabilityreport/scanner.go
index 51b9d91..e894df7 100644
--- a/pkg/vulnerabilityreport/scanner.go
+++ b/pkg/vulnerabilityreport/scanner.go
@@ -61,10 +61,10 @@ func NewScanner(
 // or fails. When succeeded it parses container logs and coverts the output
 // to instances of v1alpha1.VulnerabilityReport by delegating such transformation
 // logic also to the Plugin.
-func (s *Scanner) Scan(ctx context.Context, workload kube.Object) ([]v1alpha1.VulnerabilityReport, error) {
+func (s *Scanner) Scan(ctx context.Context, workload kube.ObjectRef) ([]v1alpha1.VulnerabilityReport, error) {
 	klog.V(3).Infof("Getting Pod template for workload: %v", workload)
 
-	workloadObj, err := s.objectResolver.GetObjectFromPartialObject(ctx, workload)
+	workloadObj, err := s.objectResolver.ObjectFromObjectRef(ctx, workload)
 	if err != nil {
 		return nil, fmt.Errorf("resolving object: %w", err)
 	}


Test patch:
diff --git a/itest/helper/helper.go b/itest/helper/helper.go
index e6e4752..1a823e9 100644
--- a/itest/helper/helper.go
+++ b/itest/helper/helper.go
@@ -444,7 +444,7 @@ func (h *Helper) GetActiveReplicaSetForDeployment(namespace, name string) (*apps
 
 func (h *Helper) HasCISKubeBenchReportOwnedBy(node corev1.Node) func() (bool, error) {
 	return func() (bool, error) {
-		report, err := h.kubeBenchReportReader.FindByOwner(context.Background(), kube.Object{Kind: kube.KindNode, Name: node.Name})
+		report, err := h.kubeBenchReportReader.FindByOwner(context.Background(), kube.ObjectRef{Kind: kube.KindNode, Name: node.Name})
 		if err != nil {
 			return false, err
 		}
diff --git a/itest/matcher/matcher.go b/itest/matcher/matcher.go
index 00f2e2d..0401bf9 100644
--- a/itest/matcher/matcher.go
+++ b/itest/matcher/matcher.go
@@ -109,7 +109,7 @@ func (m *vulnerabilityReportMatcher) objectToLabelsAsMatchKeys(obj client.Object
 		kind = gvk.Kind
 	}
 
-	labels := kube.PartialObjectToLabels(kube.Object{
+	labels := kube.ObjectRefToLabels(kube.ObjectRef{
 		Kind:      kube.Kind(kind),
 		Name:      obj.GetName(),
 		Namespace: obj.GetNamespace(),
diff --git a/itest/starboard/starboard_cli_test.go b/itest/starboard/starboard_cli_test.go
index 988372e..f0b428f 100644
--- a/itest/starboard/starboard_cli_test.go
+++ b/itest/starboard/starboard_cli_test.go
@@ -222,7 +222,7 @@ var _ = Describe("Starboard CLI", func() {
 				}, GinkgoWriter, GinkgoWriter)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindPod,
 					Name:      pod.Name,
 					Namespace: pod.Namespace,
@@ -266,7 +266,7 @@ var _ = Describe("Starboard CLI", func() {
 				}, GinkgoWriter, GinkgoWriter)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindPod,
 					Name:      pod.Name,
 					Namespace: pod.Namespace,
@@ -476,7 +476,7 @@ var _ = Describe("Starboard CLI", func() {
 				}, GinkgoWriter, GinkgoWriter)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindReplicaSet,
 					Name:      rs.Name,
 					Namespace: rs.Namespace,
@@ -541,7 +541,7 @@ var _ = Describe("Starboard CLI", func() {
 				}, GinkgoWriter, GinkgoWriter)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindReplicationController,
 					Name:      rc.Name,
 					Namespace: rc.Namespace,
@@ -595,7 +595,7 @@ var _ = Describe("Starboard CLI", func() {
 				revision, err := objectResolver.ReplicaSetByDeployment(ctx, deploy)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindReplicaSet,
 					Name:      revision.Name,
 					Namespace: revision.Namespace,
@@ -649,7 +649,7 @@ var _ = Describe("Starboard CLI", func() {
 				revision, err := objectResolver.ReplicaSetByDeployment(ctx, deploy)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindReplicaSet,
 					Name:      revision.Name,
 					Namespace: revision.Namespace,
@@ -716,7 +716,7 @@ var _ = Describe("Starboard CLI", func() {
 				}, GinkgoWriter, GinkgoWriter)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindStatefulSet,
 					Name:      sts.Name,
 					Namespace: sts.Namespace,
@@ -782,7 +782,7 @@ var _ = Describe("Starboard CLI", func() {
 				}, GinkgoWriter, GinkgoWriter)
 				Expect(err).ToNot(HaveOccurred())
 
-				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.Object{
+				reports, err := vulnerabilityreport.NewReadWriter(kubeClient).FindByOwner(ctx, kube.ObjectRef{
 					Kind:      kube.KindDaemonSet,
 					Name:      ds.Name,
 					Namespace: ds.Namespace,
diff --git a/pkg/configauditreport/builder_test.go b/pkg/configauditreport/builder_test.go
index 194b0be..1696bd3 100644
--- a/pkg/configauditreport/builder_test.go
+++ b/pkg/configauditreport/builder_test.go
@@ -175,7 +175,7 @@ func TestScanJobBuilder(t *testing.T) {
 		g.Expect(err).ToNot(HaveOccurred())
 		g.Expect(job).To(Equal(&batchv1.Job{
 			ObjectMeta: metav1.ObjectMeta{
-				Name:      "scan-configauditreport-fcc9884cb",
+				Name:      "scan-configauditreport-64d65c457",
 				Namespace: "starboard-ns",
 				Labels: map[string]string{
 					starboard.LabelResourceSpecHash:         "58b8989656",
@@ -235,7 +235,7 @@ func TestScanJobBuilder(t *testing.T) {
 		g.Expect(job).NotTo(BeNil())
 		g.Expect(job).To(Equal(&batchv1.Job{
 			ObjectMeta: metav1.ObjectMeta{
-				Name:      "scan-configauditreport-58ddcc9dcb",
+				Name:      "scan-configauditreport-5bfbdd65c9",
 				Namespace: "starboard-ns",
 				Labels: map[string]string{
 					starboard.LabelResourceSpecHash:         "7c48697ccf",
diff --git a/pkg/configauditreport/io_test.go b/pkg/configauditreport/io_test.go
index 0e23b54..8e1982b 100644
--- a/pkg/configauditreport/io_test.go
+++ b/pkg/configauditreport/io_test.go
@@ -167,7 +167,7 @@ func TestReadWriter(t *testing.T) {
 			}).Build()
 
 		readWriter := configauditreport.NewReadWriter(client)
-		found, err := readWriter.FindReportByOwner(context.TODO(), kube.Object{
+		found, err := readWriter.FindReportByOwner(context.TODO(), kube.ObjectRef{
 			Kind:      kube.KindDeployment,
 			Name:      "my-deploy",
 			Namespace: "my-namespace",
@@ -223,7 +223,7 @@ func TestReadWriter(t *testing.T) {
 			}).Build()
 
 		readWriter := configauditreport.NewReadWriter(client)
-		found, err := readWriter.FindReportByOwner(context.TODO(), kube.Object{
+		found, err := readWriter.FindReportByOwner(context.TODO(), kube.ObjectRef{
 			Kind:      kube.KindRole,
 			Name:      "system:controller:token-cleaner",
 			Namespace: "kube-system",
@@ -392,7 +392,7 @@ func TestReadWriter(t *testing.T) {
 			Build()
 
 		readWriter := configauditreport.NewReadWriter(client)
-		found, err := readWriter.FindClusterReportByOwner(context.TODO(), kube.Object{
+		found, err := readWriter.FindClusterReportByOwner(context.TODO(), kube.ObjectRef{
 			Kind: "ClusterRole",
 			Name: "editor",
 		})
diff --git a/pkg/kube/object_test.go b/pkg/kube/object_test.go
index 12310a7..111bbcf 100644
--- a/pkg/kube/object_test.go
+++ b/pkg/kube/object_test.go
@@ -94,15 +94,15 @@ func TestIsClusterScopedKind(t *testing.T) {
 	}
 }
 
-func TestPartialObjectToLabels(t *testing.T) {
+func TestObjectRefToLabels(t *testing.T) {
 	testCases := []struct {
 		name   string
-		object kube.Object
+		object kube.ObjectRef
 		labels map[string]string
 	}{
 		{
 			name: "Should map object with simple name",
-			object: kube.Object{
+			object: kube.ObjectRef{
 				Kind:      kube.KindPod,
 				Name:      "my-pod",
 				Namespace: "production",
@@ -115,7 +115,7 @@ func TestPartialObjectToLabels(t *testing.T) {
 		},
 		{
 			name: "Should map object with name that is not a valid label",
-			object: kube.Object{
+			object: kube.ObjectRef{
 				Kind: kube.KindClusterRole,
 				Name: "system:controller:namespace-controller",
 			},
@@ -128,7 +128,7 @@ func TestPartialObjectToLabels(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.labels, kube.PartialObjectToLabels(tc.object))
+			assert.Equal(t, tc.labels, kube.ObjectRefToLabels(tc.object))
 		})
 	}
 }
@@ -242,12 +242,12 @@ func TestContainerImages_AsJSON_And_FromJSON(t *testing.T) {
 	assert.Equal(t, containerImages, newContainerImages)
 }
 
-func TestGetPartialObjectFromKindAndNamespacedName(t *testing.T) {
-	partial := kube.GetPartialObjectFromKindAndNamespacedName(kube.KindReplicaSet, types.NamespacedName{
+func TestObjectRefFromKindAndNamespacedName(t *testing.T) {
+	partial := kube.ObjectRefFromKindAndNamespacedName(kube.KindReplicaSet, types.NamespacedName{
 		Namespace: "prod",
 		Name:      "wordpress",
 	})
-	assert.Equal(t, kube.Object{
+	assert.Equal(t, kube.ObjectRef{
 		Kind:      kube.KindReplicaSet,
 		Name:      "wordpress",
 		Namespace: "prod",
@@ -568,7 +568,7 @@ func TestObjectResolver_GetRelatedReplicasetName(t *testing.T) {
 	).Build()}
 
 	t.Run("Should return error for unsupported kind", func(t *testing.T) {
-		_, err := instance.GetRelatedReplicasetName(context.Background(), kube.Object{
+		_, err := instance.GetRelatedReplicasetName(context.Background(), kube.ObjectRef{
 			Kind:      kube.KindStatefulSet,
 			Name:      "statefulapp",
 			Namespace: corev1.NamespaceDefault,
@@ -577,7 +577,7 @@ func TestObjectResolver_GetRelatedReplicasetName(t *testing.T) {
 	})
 
 	t.Run("Should return ReplicaSet name for the specified Deployment", func(t *testing.T) {
-		name, err := instance.GetRelatedReplicasetName(context.Background(), kube.Object{
+		name, err := instance.GetRelatedReplicasetName(context.Background(), kube.ObjectRef{
 			Kind:      kube.KindDeployment,
 			Name:      "nginx",
 			Namespace: corev1.NamespaceDefault,
@@ -587,7 +587,7 @@ func TestObjectResolver_GetRelatedReplicasetName(t *testing.T) {
 	})
 
 	t.Run("Should return ReplicaSet name for the specified Deployment", func(t *testing.T) {
-		name, err := instance.GetRelatedReplicasetName(context.Background(), kube.Object{
+		name, err := instance.GetRelatedReplicasetName(context.Background(), kube.ObjectRef{
 			Kind:      kube.KindPod,
 			Name:      "nginx-549f5fcb58-7cr5b",
 			Namespace: corev1.NamespaceDefault,
@@ -598,11 +598,11 @@ func TestObjectResolver_GetRelatedReplicasetName(t *testing.T) {
 
 }
 
-func TestPartialObjectFromObjectMetadata(t *testing.T) {
+func TestObjectRefFromObjectMeta(t *testing.T) {
 	testCases := []struct {
 		name          string
 		object        metav1.ObjectMeta
-		expected      kube.Object
+		expected      kube.ObjectRef
 		expectedError string
 	}{
 		{
@@ -617,7 +617,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName: "system:admin",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindRole, Name: "system:admin", Namespace: "kube-system"},
+			expected: kube.ObjectRef{Kind: kube.KindRole, Name: "system:admin", Namespace: "kube-system"},
 		},
 		{
 			name: "Test RoleBinding",
@@ -631,7 +631,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName: "system:admin:binding",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindRoleBinding, Name: "system:admin:binding", Namespace: "kube-system"},
+			expected: kube.ObjectRef{Kind: kube.KindRoleBinding, Name: "system:admin:binding", Namespace: "kube-system"},
 		},
 		{
 			name: "Kind ClusterRole",
@@ -645,7 +645,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName: "system:netnode",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindClusterRole, Name: "system:netnode"},
+			expected: kube.ObjectRef{Kind: kube.KindClusterRole, Name: "system:netnode"},
 		},
 		{
 			name: "Kind ClusterRoleBinding",
@@ -659,7 +659,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName: "system:netnode:binding",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindClusterRoleBindings, Name: "system:netnode:binding"},
+			expected: kube.ObjectRef{Kind: kube.KindClusterRoleBindings, Name: "system:netnode:binding"},
 		},
 		{
 			name: "Kind Pod",
@@ -670,7 +670,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName:      "nginx-pod",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindPod, Name: "nginx-pod", Namespace: "default"},
+			expected: kube.ObjectRef{Kind: kube.KindPod, Name: "nginx-pod", Namespace: "default"},
 		},
 		{
 			name: "Kind Deployment",
@@ -681,7 +681,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName:      "nginx-deployment",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindDeployment, Name: "nginx-deployment", Namespace: "default"},
+			expected: kube.ObjectRef{Kind: kube.KindDeployment, Name: "nginx-deployment", Namespace: "default"},
 		},
 		{
 			name: "Kind DaemonSet",
@@ -692,7 +692,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 					starboard.LabelResourceName:      "nginx-ds",
 				},
 			},
-			expected: kube.Object{Kind: kube.KindDaemonSet, Name: "nginx-ds", Namespace: "default"},
+			expected: kube.ObjectRef{Kind: kube.KindDaemonSet, Name: "nginx-ds", Namespace: "default"},
 		},
 		{
 			name: fmt.Sprintf("Should return error when %s label is missing", starboard.LabelResourceKind),
@@ -708,7 +708,7 @@ func TestPartialObjectFromObjectMetadata(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			actual, err := kube.PartialObjectFromObjectMetadata(tc.object)
+			actual, err := kube.ObjectRefFromObjectMeta(tc.object)
 			if tc.expectedError == "" {
 				require.NoError(t, err)
 				assert.Equal(t, tc.expected, actual)
diff --git a/pkg/kubebench/io_test.go b/pkg/kubebench/io_test.go
index 9d635bc..225a3ba 100644
--- a/pkg/kubebench/io_test.go
+++ b/pkg/kubebench/io_test.go
@@ -214,7 +214,7 @@ func TestReadWriter(t *testing.T) {
 			Build()
 		instance := kubebench.NewReadWriter(client)
 
-		found, err := instance.FindByOwner(context.Background(), kube.Object{Name: "worker"})
+		found, err := instance.FindByOwner(context.Background(), kube.ObjectRef{Name: "worker"})
 		require.NoError(t, err)
 
 		assert.Equal(t, &v1alpha1.CISKubeBenchReport{
diff --git a/pkg/plugin/conftest/plugin_test.go b/pkg/plugin/conftest/plugin_test.go
index 48ad6e0..e6ae811 100644
--- a/pkg/plugin/conftest/plugin_test.go
+++ b/pkg/plugin/conftest/plugin_test.go
@@ -402,7 +402,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 		"Affinity":                     Equal(starboard.LinuxNodeAffinity()),
 		"Volumes": ConsistOf(
 			MatchFields(IgnoreExtras, Fields{
-				"Name": Equal("scan-configauditreport-5d4445db4f-volume"),
+				"Name": Equal("scan-configauditreport-789cbb5cc4-volume"),
 				// We cannot inline assert here on other properties with the MatchFields matcher
 				// because the value of the Secret field is the pointer to v1.SecretVolumeSource.
 				// The MatchFields matcher only works with structs :-(
@@ -426,31 +426,31 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 				}),
 				"VolumeMounts": ConsistOf(
 					corev1.VolumeMount{
-						Name:      "scan-configauditreport-5d4445db4f-volume",
+						Name:      "scan-configauditreport-789cbb5cc4-volume",
 						MountPath: "/project/policy/kubernetes.rego",
 						SubPath:   "kubernetes.rego",
 						ReadOnly:  true,
 					},
 					corev1.VolumeMount{
-						Name:      "scan-configauditreport-5d4445db4f-volume",
+						Name:      "scan-configauditreport-789cbb5cc4-volume",
 						MountPath: "/project/policy/utils.rego",
 						SubPath:   "utils.rego",
 						ReadOnly:  true,
 					},
 					corev1.VolumeMount{
-						Name:      "scan-configauditreport-5d4445db4f-volume",
+						Name:      "scan-configauditreport-789cbb5cc4-volume",
 						MountPath: "/project/policy/access_to_host_pid.rego",
 						SubPath:   "access_to_host_pid.rego",
 						ReadOnly:  true,
 					},
 					corev1.VolumeMount{
-						Name:      "scan-configauditreport-5d4445db4f-volume",
+						Name:      "scan-configauditreport-789cbb5cc4-volume",
 						MountPath: "/project/policy/cpu_not_limited.rego",
 						SubPath:   "cpu_not_limited.rego",
 						ReadOnly:  true,
 					},
 					corev1.VolumeMount{
-						Name:      "scan-configauditreport-5d4445db4f-volume",
+						Name:      "scan-configauditreport-789cbb5cc4-volume",
 						MountPath: "/project/workload.yaml",
 						SubPath:   "workload.yaml",
 						ReadOnly:  true,
@@ -476,7 +476,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 		"SecurityContext": Equal(&corev1.PodSecurityContext{}),
 	}))
 	g.Expect(*jobSpec.Volumes[0].VolumeSource.Secret).To(MatchFields(IgnoreExtras, Fields{
-		"SecretName": Equal("scan-configauditreport-5d4445db4f-volume"),
+		"SecretName": Equal("scan-configauditreport-789cbb5cc4-volume"),
 		"Items": ConsistOf(
 			corev1.KeyToPath{
 				Key:  "conftest.library.kubernetes.rego",
@@ -503,7 +503,7 @@ func TestPlugin_GetScanJobSpec(t *testing.T) {
 	g.Expect(secrets).To(ConsistOf(
 		&corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{
-				Name:      "scan-configauditreport-5d4445db4f-volume",
+				Name:      "scan-configauditreport-789cbb5cc4-volume",
 				Namespace: "starboard-ns",
 			},
 			StringData: map[string]string{
diff --git a/pkg/vulnerabilityreport/builder_test.go b/pkg/vulnerabilityreport/builder_test.go
index f3690b4..566ec26 100644
--- a/pkg/vulnerabilityreport/builder_test.go
+++ b/pkg/vulnerabilityreport/builder_test.go
@@ -99,7 +99,7 @@ func TestScanJobBuilder(t *testing.T) {
 	g.Expect(job).ToNot(gomega.BeNil())
 	g.Expect(job).To(gomega.Equal(&batchv1.Job{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      "scan-vulnerabilityreport-fcc9884cb",
+			Name:      "scan-vulnerabilityreport-64d65c457",
 			Namespace: "starboard-ns",
 			Labels: map[string]string{
 				starboard.LabelK8SAppManagedBy:            "starboard",
diff --git a/pkg/vulnerabilityreport/io_test.go b/pkg/vulnerabilityreport/io_test.go
index a6430ae..d74fde4 100644
--- a/pkg/vulnerabilityreport/io_test.go
+++ b/pkg/vulnerabilityreport/io_test.go
@@ -241,7 +241,7 @@ func TestNewReadWriter(t *testing.T) {
 		}).Build()
 
 		readWriter := vulnerabilityreport.NewReadWriter(client)
-		list, err := readWriter.FindByOwner(context.TODO(), kube.Object{
+		list, err := readWriter.FindByOwner(context.TODO(), kube.ObjectRef{
 			Kind:      kube.KindDeployment,
 			Name:      "my-deploy",
 			Namespace: "my-namespace",