Repository: aquasecurity/starboard
Pull request #531 (2021-04-23 10:55:28)

refactor: Use embed package to define ConfigAuditReports CRD
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#531](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (adb6504) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/21e893cb41c75144f9877735303bbf783c3f80bc?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (21e893c) will **decrease** coverage by `34.35%`.
> The diff coverage is `30.00%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/531/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #531       +/-   ##
===========================================
- Coverage   70.70%   36.34%   -34.36%     
===========================================
  Files          63       62        -1     
  Lines        4028     3904      -124     
===========================================
- Hits         2848     1419     -1429     
- Misses        871     2400     +1529     
+ Partials      309       85      -224     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/kube/cr\_manager.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvY3JfbWFuYWdlci5nbw==) | `0.00% <0.00%> (-50.00%)` | :arrow_down: |
| [pkg/plugin/conftest/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9jb25mdGVzdC9wbHVnaW4uZ28=) | `87.50% <50.00%> (ø)` | |
| [pkg/plugin/polaris/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9wb2xhcmlzL3BsdWdpbi5nbw==) | `89.92% <50.00%> (-1.44%)` | :arrow_down: |
| [pkg/cmd/get.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9nZXQuZ28=) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/find.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9maW5kLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/root.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9yb290Lmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/scan.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9zY2FuLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/polaris.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9wb2xhcmlzLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/version.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC92ZXJzaW9uLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [pkg/cmd/kube\_bench.go](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NtZC9rdWJlX2JlbmNoLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| ... and [35 more](https://codecov.io/gh/aquasecurity/starboard/pull/531/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [ca59eb2...adb6504](https://codecov.io/gh/aquasecurity/starboard/pull/531?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/static/05-starboard-operator.config.yaml b/deploy/static/05-starboard-operator.config.yaml
index 73ac9d0..cb4d509 100644
--- a/deploy/static/05-starboard-operator.config.yaml
+++ b/deploy/static/05-starboard-operator.config.yaml
@@ -211,9 +211,3 @@ kind: Secret
 metadata:
   name: starboard
   namespace: starboard-operator
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: starboard-conftest-config
-  namespace: starboard-operator
diff --git a/embedded.go b/embedded.go
index aebdda4..0246582 100644
--- a/embedded.go
+++ b/embedded.go
@@ -10,11 +10,21 @@ import (
 var (
 	//go:embed deploy/crd/vulnerabilityreports.crd.yaml
 	vulnerabilityReportsCRD []byte
+	//go:embed deploy/crd/configauditreports.crd.yaml
+	configAuditReportsCRD []byte
 )
 
 func GetVulnerabilityReportsCRD() (apiextensionsv1.CustomResourceDefinition, error) {
+	return getCRDFromBytes(vulnerabilityReportsCRD)
+}
+
+func GetConfigAuditReportsCRD() (apiextensionsv1.CustomResourceDefinition, error) {
+	return getCRDFromBytes(configAuditReportsCRD)
+}
+
+func getCRDFromBytes(bytes []byte) (apiextensionsv1.CustomResourceDefinition, error) {
 	var crd apiextensionsv1.CustomResourceDefinition
-	_, _, err := scheme.Codecs.UniversalDecoder().Decode(vulnerabilityReportsCRD, nil, &crd)
+	_, _, err := scheme.Codecs.UniversalDecoder().Decode(bytes, nil, &crd)
 	if err != nil {
 		return apiextensionsv1.CustomResourceDefinition{}, err
 	}
diff --git a/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go b/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
index 27e7478..a84655d 100644
--- a/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
@@ -1,11 +1,7 @@
 package v1alpha1
 
 import (
-	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/utils/pointer"
 )
 
 const (
@@ -15,76 +11,9 @@ const (
 	ConfigAuditReportListKind  = "ConfigAuditReportList"
 )
 
-var (
-	// TODO Once we migrate to Go 1.16 we can use the embed package to load the CRD from ./deploy/crd/configauditreports.crd.yaml
-	ConfigAuditReportCRD = apiextensionsv1.CustomResourceDefinition{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: ConfigAuditReportCRName,
-			Labels: labels.Set{
-				"app.kubernetes.io/managed-by": "starboard",
-			},
-		},
-		Spec: apiextensionsv1.CustomResourceDefinitionSpec{
-			Group: aquasecurity.GroupName,
-			Versions: []apiextensionsv1.CustomResourceDefinitionVersion{
-				{
-					Name:    ConfigAuditReportCRVersion,
-					Served:  true,
-					Storage: true,
-					AdditionalPrinterColumns: []apiextensionsv1.CustomResourceColumnDefinition{
-						{
-							JSONPath: ".report.scanner.name",
-							Type:     "string",
-							Name:     "Scanner",
-						},
-						{
-							JSONPath: ".metadata.creationTimestamp",
-							Type:     "date",
-							Name:     "Age",
-						},
-						{
-							JSONPath: ".report.summary.dangerCount",
-							Type:     "integer",
-							Name:     "Danger",
-							Priority: 1,
-						},
-						{
-							JSONPath: ".report.summary.warningCount",
-							Type:     "integer",
-							Name:     "Warning",
-							Priority: 1,
-						},
-						{
-							JSONPath: ".report.summary.passCount",
-							Type:     "integer",
-							Name:     "Pass",
-							Priority: 1,
-						},
-					},
-					Schema: &apiextensionsv1.CustomResourceValidation{
-						OpenAPIV3Schema: &apiextensionsv1.JSONSchemaProps{
-							XPreserveUnknownFields: pointer.BoolPtr(true),
-							Type:                   "object",
-						},
-					},
-				},
-			},
-			Scope: apiextensionsv1.NamespaceScoped,
-			Names: apiextensionsv1.CustomResourceDefinitionNames{
-				Singular:   "configauditreport",
-				Plural:     "configauditreports",
-				Kind:       ConfigAuditReportKind,
-				ListKind:   ConfigAuditReportListKind,
-				Categories: []string{"all"},
-				ShortNames: []string{"configaudit"},
-			},
-		},
-	}
-)
-
 const (
-	ConfigAuditDangerSeverity  = "danger"
-	ConfigAuditWarningSeverity = "warning"
+	ConfigAuditSeverityDanger  = "danger"
+	ConfigAuditSeverityWarning = "warning"
 )
 
 type ConfigAuditSummary struct {
diff --git a/pkg/kube/cr_manager.go b/pkg/kube/cr_manager.go
index 81c16ff..dd3bea4 100644
--- a/pkg/kube/cr_manager.go
+++ b/pkg/kube/cr_manager.go
@@ -157,7 +157,11 @@ func (m *CRManager) Init(ctx context.Context) error {
 		return err
 	}
 
-	err = m.createOrUpdateCRD(ctx, &v1alpha1.ConfigAuditReportCRD)
+	configAuditReportsCRD, err := embedded.GetConfigAuditReportsCRD()
+	if err != nil {
+		return err
+	}
+	err = m.createOrUpdateCRD(ctx, &configAuditReportsCRD)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/plugin/polaris/plugin.go b/pkg/plugin/polaris/plugin.go
index af84953..0004f20 100644
--- a/pkg/plugin/polaris/plugin.go
+++ b/pkg/plugin/polaris/plugin.go
@@ -207,9 +207,9 @@ func (p *plugin) configAuditSummaryFrom(podChecks []v1alpha1.Check, containerChe
 			continue
 		}
 		switch c.Severity {
-		case v1alpha1.ConfigAuditDangerSeverity:
+		case v1alpha1.ConfigAuditSeverityDanger:
 			summary.DangerCount++
-		case v1alpha1.ConfigAuditWarningSeverity:
+		case v1alpha1.ConfigAuditSeverityWarning:
 			summary.WarningCount++
 		}
 	}
@@ -220,9 +220,9 @@ func (p *plugin) configAuditSummaryFrom(podChecks []v1alpha1.Check, containerChe
 				continue
 			}
 			switch c.Severity {
-			case v1alpha1.ConfigAuditDangerSeverity:
+			case v1alpha1.ConfigAuditSeverityDanger:
 				summary.DangerCount++
-			case v1alpha1.ConfigAuditWarningSeverity:
+			case v1alpha1.ConfigAuditSeverityWarning:
 				summary.WarningCount++
 			}
 		}
diff --git a/pkg/starboard/config.go b/pkg/starboard/config.go
index 4abc863..d5da9b7 100644
--- a/pkg/starboard/config.go
+++ b/pkg/starboard/config.go
@@ -284,12 +284,17 @@ func GetDefaultConfig() ConfigData {
 }
 
 // GetDefaultPolarisConfig returns the default Polaris configuration.
-func GetDefaultPolarisConfig() ConfigData {
+func GetDefaultPolarisConfig() map[string]string {
 	return map[string]string{
 		"polaris.config.yaml": polarisConfigYAML,
 	}
 }
 
+// GetDefaultConftestConfig return the defautl Conftest configuration.
+func GetDefaultConftestConfig() map[string]string {
+	return map[string]string{}
+}
+
 func (c ConfigData) GetVulnerabilityReportsScanner() (Scanner, error) {
 	var ok bool
 	var value string
@@ -424,49 +429,70 @@ type configManager struct {
 }
 
 func (c *configManager) EnsureDefault(ctx context.Context) error {
-	cm := &corev1.ConfigMap{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: c.namespace,
-			Name:      ConfigMapName,
-			Labels: labels.Set{
-				"app.kubernetes.io/managed-by": "starboard",
+	cm, err := c.client.CoreV1().ConfigMaps(c.namespace).Get(ctx, ConfigMapName, metav1.GetOptions{})
+	if err != nil {
+		if !apierrors.IsNotFound(err) {
+			return fmt.Errorf("getting config: %w", err)
+		}
+
+		cm, err = c.client.CoreV1().ConfigMaps(c.namespace).Create(ctx, &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Namespace: c.namespace,
+				Name:      ConfigMapName,
+				Labels: labels.Set{
+					LabelK8SAppManagedBy: "starboard",
+				},
 			},
-		},
-		Data: GetDefaultConfig(),
-	}
-	_, err := c.client.CoreV1().ConfigMaps(c.namespace).Create(ctx, cm, metav1.CreateOptions{})
-	if err != nil && !apierrors.IsAlreadyExists(err) {
-		return err
+			Data: GetDefaultConfig(),
+		}, metav1.CreateOptions{})
+
+		if err != nil {
+			return fmt.Errorf("creating config: %w", err)
+		}
 	}
 
-	polarisCm := &corev1.ConfigMap{
+	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: c.namespace,
-			Name:      GetPluginConfigMapName(string(Polaris)),
+			Name:      SecretName,
 			Labels: labels.Set{
-				"app.kubernetes.io/managed-by": "starboard",
+				LabelK8SAppManagedBy: "starboard",
 			},
 		},
-		Data: GetDefaultPolarisConfig(),
 	}
-	_, err = c.client.CoreV1().ConfigMaps(c.namespace).Create(ctx, polarisCm, metav1.CreateOptions{})
+	_, err = c.client.CoreV1().Secrets(c.namespace).Create(ctx, secret, metav1.CreateOptions{})
 	if err != nil && !apierrors.IsAlreadyExists(err) {
 		return err
 	}
 
-	secret := &corev1.Secret{
+	scanner, err := ConfigData(cm.Data).GetConfigAuditReportsScanner()
+	if err != nil {
+		return fmt.Errorf("getting scanner: %w", err)
+	}
+
+	var pluginConfigData map[string]string
+	switch scanner {
+	case Polaris:
+		pluginConfigData = GetDefaultPolarisConfig()
+	case Conftest:
+		pluginConfigData = GetDefaultConftestConfig()
+	}
+
+	pluginConfig := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: c.namespace,
-			Name:      SecretName,
+			Name:      GetPluginConfigMapName(string(scanner)),
 			Labels: labels.Set{
-				"app.kubernetes.io/managed-by": "starboard",
+				LabelK8SAppManagedBy: "starboard",
 			},
 		},
+		Data: pluginConfigData,
 	}
-	_, err = c.client.CoreV1().Secrets(c.namespace).Create(ctx, secret, metav1.CreateOptions{})
+	_, err = c.client.CoreV1().ConfigMaps(c.namespace).Create(ctx, pluginConfig, metav1.CreateOptions{})
 	if err != nil && !apierrors.IsAlreadyExists(err) {
 		return err
 	}
+
 	return nil
 }
 


Test patch:
diff --git a/pkg/plugin/conftest/plugin.go b/pkg/plugin/conftest/plugin.go
index 2a43550..29efbff 100644
--- a/pkg/plugin/conftest/plugin.go
+++ b/pkg/plugin/conftest/plugin.go
@@ -24,8 +24,6 @@ const (
 	policyPrefix          = "conftest.policy."
 	workloadKey           = "starboard.workload.yaml"
 	defaultCheckCategory  = "Security"
-	severityWarning       = "WARNING"
-	severityDanger        = "DANGER"
 )
 
 type Config interface {
@@ -212,7 +210,7 @@ func (p *plugin) ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.
 		for _, warning := range cr.Warnings {
 			checks = append(checks, v1alpha1.Check{
 				ID:       p.getPolicyTitleFromResult(warning),
-				Severity: severityWarning,
+				Severity: v1alpha1.ConfigAuditSeverityWarning,
 				Message:  warning.Message,
 				Category: defaultCheckCategory,
 				Success:  false,
@@ -223,7 +221,7 @@ func (p *plugin) ParseConfigAuditReportData(logsReader io.ReadCloser) (v1alpha1.
 		for _, failure := range cr.Failures {
 			checks = append(checks, v1alpha1.Check{
 				ID:       p.getPolicyTitleFromResult(failure),
-				Severity: severityDanger,
+				Severity: v1alpha1.ConfigAuditSeverityDanger,
 				Message:  failure.Message,
 				Category: defaultCheckCategory,
 			})
diff --git a/pkg/plugin/conftest/plugin_test.go b/pkg/plugin/conftest/plugin_test.go
index 46f4a4e..aadd9e4 100644
--- a/pkg/plugin/conftest/plugin_test.go
+++ b/pkg/plugin/conftest/plugin_test.go
@@ -304,35 +304,35 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container kubedns of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "DANGER",
+				Severity: "danger",
 				Category: "Security",
 			}),
 			"container dnsmasq of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container dnsmasq of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "DANGER",
+				Severity: "danger",
 				Category: "Security",
 			}),
 			"container sidecar of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container sidecar of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "DANGER",
+				Severity: "danger",
 				Category: "Security",
 			}),
 			"container prometheus-to-sd of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container prometheus-to-sd of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "DANGER",
+				Severity: "danger",
 				Category: "Security",
 			}),
 			"container dnsmasq of deployment kube-dns in default namespace should set securityContext.readOnlyRootFilesystem to true": Equal(v1alpha1.Check{
 				ID:       "Root file system is not read-only",
 				Message:  "container dnsmasq of deployment kube-dns in default namespace should set securityContext.readOnlyRootFilesystem to true",
 				Success:  false,
-				Severity: "DANGER",
+				Severity: "danger",
 				Category: "Security",
 			}),
 			"container prometheus-to-sd of deployment kube-dns in default namespace should set resources.requests.cpu": Equal(v1alpha1.Check{
@@ -342,7 +342,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 				ID:       "00000000-0000-0000-0000-000000000001",
 				Message:  "container prometheus-to-sd of deployment kube-dns in default namespace should set resources.requests.cpu",
 				Success:  false,
-				Severity: "DANGER",
+				Severity: "danger",
 				Category: "Security",
 			}),
 		}),
diff --git a/pkg/starboard/config_test.go b/pkg/starboard/config_test.go
index 82d9105..262ffdc 100644
--- a/pkg/starboard/config_test.go
+++ b/pkg/starboard/config_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/aquasecurity/starboard/pkg/starboard"
+	"github.com/onsi/gomega"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
@@ -324,67 +325,204 @@ func TestConfigManager_Read(t *testing.T) {
 
 func TestConfigManager_EnsureDefault(t *testing.T) {
 
-	t.Run("Should create ConfigMap with default values, and empty secret", func(t *testing.T) {
+	t.Run("Should create ConfigMaps and Secret", func(t *testing.T) {
+		g := gomega.NewGomegaWithT(t)
+
+		namespace := "starboard-ns"
 		clientset := fake.NewSimpleClientset()
 
-		err := starboard.NewConfigManager(clientset, starboard.NamespaceName).EnsureDefault(context.TODO())
-		require.NoError(t, err)
+		err := starboard.NewConfigManager(clientset, namespace).EnsureDefault(context.TODO())
+		g.Expect(err).ToNot(gomega.HaveOccurred())
 
-		cm, err := clientset.CoreV1().
-			ConfigMaps(starboard.NamespaceName).
+		cm, err := clientset.CoreV1().ConfigMaps(namespace).
 			Get(context.TODO(), starboard.ConfigMapName, metav1.GetOptions{})
-		require.NoError(t, err)
-		assert.Equal(t, starboard.GetDefaultConfig(), starboard.ConfigData(cm.Data))
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(cm.Data).To(gomega.BeEquivalentTo(starboard.GetDefaultConfig()))
 
-		secret, err := clientset.CoreV1().
-			Secrets(starboard.NamespaceName).
+		secret, err := clientset.CoreV1().Secrets(namespace).
 			Get(context.TODO(), starboard.SecretName, metav1.GetOptions{})
-		require.NoError(t, err)
-		assert.Equal(t, map[string][]byte(nil), secret.Data)
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(secret.Data).To(gomega.BeEmpty())
+
+		pluginConfig, err := clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Polaris)), metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(pluginConfig.Data).To(gomega.Equal(starboard.GetDefaultPolarisConfig()))
+
+		_, err = clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Conftest)), metav1.GetOptions{})
+		g.Expect(err).To(gomega.MatchError(`configmaps "starboard-conftest-config" not found`))
 	})
 
-	t.Run("Should not modify ConfigMap nor secret if they already exist", func(t *testing.T) {
+	t.Run("Should not modify ConfigMaps nor Secret", func(t *testing.T) {
+		g := gomega.NewGomegaWithT(t)
+		namespace := "starboard-ns"
 		clientset := fake.NewSimpleClientset(
 			&corev1.ConfigMap{
 				ObjectMeta: metav1.ObjectMeta{
-					Namespace: starboard.NamespaceName,
+					Namespace: namespace,
 					Name:      starboard.ConfigMapName,
 				},
 				Data: map[string]string{
-					"foo": "bar",
+					"foo":                        "bar",
+					"configAuditReports.scanner": string(starboard.Conftest),
 				},
 			},
 			&corev1.Secret{
 				ObjectMeta: metav1.ObjectMeta{
-					Namespace: starboard.NamespaceName,
+					Namespace: namespace,
 					Name:      starboard.SecretName,
 				},
 				Data: map[string][]byte{
 					"baz": []byte("s3cret"),
 				},
 			},
+			&corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      starboard.GetPluginConfigMapName(string(starboard.Conftest)),
+				},
+				Data: map[string]string{
+					"conftest.policy.my-check.rego": "<REGO>",
+				},
+			},
 		)
 
-		err := starboard.NewConfigManager(clientset, starboard.NamespaceName).EnsureDefault(context.TODO())
-		require.NoError(t, err)
+		err := starboard.NewConfigManager(clientset, namespace).EnsureDefault(context.TODO())
+		g.Expect(err).ToNot(gomega.HaveOccurred())
 
-		cm, err := clientset.CoreV1().
-			ConfigMaps(starboard.NamespaceName).
+		cm, err := clientset.CoreV1().ConfigMaps(namespace).
 			Get(context.TODO(), starboard.ConfigMapName, metav1.GetOptions{})
-		require.NoError(t, err)
-		assert.Equal(t, map[string]string{
-			"foo": "bar",
-		}, cm.Data)
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(cm.Data).To(gomega.Equal(map[string]string{
+			"foo":                        "bar",
+			"configAuditReports.scanner": "Conftest",
+		}))
 
-		secret, err := clientset.CoreV1().
-			Secrets(starboard.NamespaceName).
+		secret, err := clientset.CoreV1().Secrets(namespace).
 			Get(context.TODO(), starboard.SecretName, metav1.GetOptions{})
-		require.NoError(t, err)
-		assert.Equal(t, map[string][]byte{
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(secret.Data).To(gomega.Equal(map[string][]byte{
 			"baz": []byte("s3cret"),
-		}, secret.Data)
+		}))
+
+		pluginConfig, err := clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Conftest)), metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(pluginConfig.Data).To(gomega.Equal(map[string]string{
+			"conftest.policy.my-check.rego": "<REGO>",
+		}))
+
+		_, err = clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Polaris)), metav1.GetOptions{})
+		g.Expect(err).To(gomega.MatchError(`configmaps "starboard-polaris-config" not found`))
 	})
 
+	t.Run("Should create ConfigMap for Polaris", func(t *testing.T) {
+		g := gomega.NewGomegaWithT(t)
+		namespace := "starboard-ns"
+		clientset := fake.NewSimpleClientset(
+			&corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      starboard.ConfigMapName,
+				},
+				Data: map[string]string{
+					"foo":                        "bar",
+					"configAuditReports.scanner": string(starboard.Polaris),
+				},
+			},
+			&corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      starboard.SecretName,
+				},
+				Data: map[string][]byte{
+					"baz": []byte("s3cret"),
+				},
+			},
+		)
+
+		err := starboard.NewConfigManager(clientset, namespace).EnsureDefault(context.TODO())
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+
+		cm, err := clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.ConfigMapName, metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(cm.Data).To(gomega.Equal(map[string]string{
+			"foo":                        "bar",
+			"configAuditReports.scanner": "Polaris",
+		}))
+
+		secret, err := clientset.CoreV1().Secrets(namespace).
+			Get(context.TODO(), starboard.SecretName, metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(secret.Data).To(gomega.Equal(map[string][]byte{
+			"baz": []byte("s3cret"),
+		}))
+
+		pluginConfig, err := clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Polaris)), metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(pluginConfig.Data).To(gomega.Equal(starboard.GetDefaultPolarisConfig()))
+
+		_, err = clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Conftest)), metav1.GetOptions{})
+		g.Expect(err).To(gomega.MatchError(`configmaps "starboard-conftest-config" not found`))
+	})
+
+	t.Run("Should create ConfigMap for Conftest", func(t *testing.T) {
+		g := gomega.NewGomegaWithT(t)
+		namespace := "starboard-ns"
+		clientset := fake.NewSimpleClientset(
+			&corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      starboard.ConfigMapName,
+				},
+				Data: map[string]string{
+					"foo":                        "bar",
+					"configAuditReports.scanner": string(starboard.Conftest),
+				},
+			},
+			&corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      starboard.SecretName,
+				},
+				Data: map[string][]byte{
+					"baz": []byte("s3cret"),
+				},
+			},
+		)
+
+		err := starboard.NewConfigManager(clientset, namespace).EnsureDefault(context.TODO())
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+
+		cm, err := clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.ConfigMapName, metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(cm.Data).To(gomega.Equal(map[string]string{
+			"foo":                        "bar",
+			"configAuditReports.scanner": "Conftest",
+		}))
+
+		secret, err := clientset.CoreV1().Secrets(namespace).
+			Get(context.TODO(), starboard.SecretName, metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(secret.Data).To(gomega.Equal(map[string][]byte{
+			"baz": []byte("s3cret"),
+		}))
+
+		pluginConfig, err := clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Conftest)), metav1.GetOptions{})
+		g.Expect(err).ToNot(gomega.HaveOccurred())
+		g.Expect(pluginConfig.Data).To(gomega.BeEmpty())
+
+		_, err = clientset.CoreV1().ConfigMaps(namespace).
+			Get(context.TODO(), starboard.GetPluginConfigMapName(string(starboard.Polaris)), metav1.GetOptions{})
+		g.Expect(err).To(gomega.MatchError(`configmaps "starboard-polaris-config" not found`))
+	})
 }
 
 func TestConfigManager_Delete(t *testing.T) {