Repository: aquasecurity/starboard
Pull request #992 (2022-03-02 12:29:44)

feat: update severity enum in config audit check
The ConfigAuditReport used danger and warning enums to describe
severity of audit checks. These enum values where inherited from
Polaris data model. This patch updates severities to CRITICAL,
HIGH, MEDIUM, and LOW.

Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#992](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (fe3890b) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/c7340d512e1f2865250dc6216cc02fd1fbbba81f?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (c7340d5) will **decrease** coverage by `17.81%`.
> The diff coverage is `68.18%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/992/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main     #992       +/-   ##
===========================================
- Coverage   62.44%   44.62%   -17.82%     
===========================================
  Files          59       42       -17     
  Lines        7325     6140     -1185     
===========================================
- Hits         4574     2740     -1834     
- Misses       2290     3232      +942     
+ Partials      461      168      -293     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/plugin/polaris/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9wb2xhcmlzL3BsdWdpbi5nbw==) | `80.49% <66.66%> (-2.06%)` | :arrow_down: |
| [pkg/plugin/conftest/plugin.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9jb25mdGVzdC9wbHVnaW4uZ28=) | `77.99% <75.00%> (-0.72%)` | :arrow_down: |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-81.49%)` | :arrow_down: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-74.49%)` | :arrow_down: |
| [pkg/kube/runnable\_job.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvcnVubmFibGVfam9iLmdv) | `0.00% <0.00%> (-63.73%)` | :arrow_down: |
| [pkg/kubehunter/model.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvbW9kZWwuZ28=) | `0.00% <0.00%> (-62.86%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-60.17%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-59.44%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-56.18%)` | :arrow_down: |
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-55.80%)` | :arrow_down: |
| ... and [32 more](https://codecov.io/gh/aquasecurity/starboard/pull/992/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [83e8fdd...fe3890b](https://codecov.io/gh/aquasecurity/starboard/pull/992?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/crd/clusterconfigauditreports.crd.yaml b/deploy/crd/clusterconfigauditreports.crd.yaml
index 63e676d..43dcca5 100644
--- a/deploy/crd/clusterconfigauditreports.crd.yaml
+++ b/deploy/crd/clusterconfigauditreports.crd.yaml
@@ -20,21 +20,26 @@ spec:
           type: date
           name: Age
           description: The age of the report
-        - jsonPath: .report.summary.dangerCount
+        - jsonPath: .report.summary.criticalCount
           type: integer
-          name: Danger
+          name: Critial
           priority: 1
-          description: The number of checks that failed with Danger status
-        - jsonPath: .report.summary.warningCount
+          description: The number of failed checks with critial severity
+        - jsonPath: .report.summary.highCount
           type: integer
-          name: Warning
+          name: High
           priority: 1
-          description: The number of checks that failed with Warning status
-        - jsonPath: .report.summary.passCount
+          description: The number of failed checks with high severity
+        - jsonPath: .report.summary.mediumCount
           type: integer
-          name: Pass
+          name: Medium
           priority: 1
-          description: The number of checks that passed
+          description: The number of failed checks with medium severity
+        - jsonPath: .report.summary.lowCount
+          type: integer
+          name: Low
+          priority: 1
+          description: The number of failed checks with low severity
       schema:
         openAPIV3Schema:
           x-kubernetes-preserve-unknown-fields: true
diff --git a/deploy/crd/configauditreports.crd.yaml b/deploy/crd/configauditreports.crd.yaml
index 2bef8b0..73662f3 100644
--- a/deploy/crd/configauditreports.crd.yaml
+++ b/deploy/crd/configauditreports.crd.yaml
@@ -20,21 +20,26 @@ spec:
           type: date
           name: Age
           description: The age of the report
-        - jsonPath: .report.summary.dangerCount
+        - jsonPath: .report.summary.criticalCount
           type: integer
-          name: Danger
+          name: Critial
           priority: 1
-          description: The number of checks that failed with Danger status
-        - jsonPath: .report.summary.warningCount
+          description: The number of failed checks with critial severity
+        - jsonPath: .report.summary.highCount
           type: integer
-          name: Warning
+          name: High
           priority: 1
-          description: The number of checks that failed with Warning status
-        - jsonPath: .report.summary.passCount
+          description: The number of failed checks with high severity
+        - jsonPath: .report.summary.mediumCount
           type: integer
-          name: Pass
+          name: Medium
           priority: 1
-          description: The number of checks that passed
+          description: The number of failed checks with medium severity
+        - jsonPath: .report.summary.lowCount
+          type: integer
+          name: Low
+          priority: 1
+          description: The number of failed checks with low severity
       schema:
         openAPIV3Schema:
           x-kubernetes-preserve-unknown-fields: true
diff --git a/pkg/apis/aquasecurity/v1alpha1/common_types.go b/pkg/apis/aquasecurity/v1alpha1/common_types.go
index ba4cd72..5a40056 100644
--- a/pkg/apis/aquasecurity/v1alpha1/common_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/common_types.go
@@ -4,6 +4,19 @@ const (
 	TTLReportAnnotation = "starboard.aquasecurity.github.io/report-ttl"
 )
 
+// Severity level of a vulnerability or a configuration audit check.
+// +enum
+type Severity string
+
+const (
+	SeverityCritical Severity = "CRITICAL"
+	SeverityHigh     Severity = "HIGH"
+	SeverityMedium   Severity = "MEDIUM"
+	SeverityLow      Severity = "LOW"
+	SeverityNone     Severity = "NONE"
+	SeverityUnknown  Severity = "UNKNOWN"
+)
+
 // Scanner is the spec for a scanner generating a security assessment report.
 type Scanner struct {
 	// Name the name of the scanner.
diff --git a/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go b/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
index 86b91e2..2a52675 100644
--- a/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/config_audit_types.go
@@ -13,15 +13,20 @@ const (
 	ClusterConfigAuditReportCRName = "clusterconfigauditreports.aquasecurity.github.io"
 )
 
-const (
-	ConfigAuditSeverityDanger  = "danger"
-	ConfigAuditSeverityWarning = "warning"
-)
-
+// ConfigAuditSummary counts failed checks by severity.
 type ConfigAuditSummary struct {
-	PassCount    int `json:"passCount"`
-	DangerCount  int `json:"dangerCount"`
-	WarningCount int `json:"warningCount"`
+
+	// CriticalCount is the number of failed checks with critical severity.
+	CriticalCount int `json:"criticalCount"`
+
+	// HighCount is the number of failed checks with high severity.
+	HighCount int `json:"highCount"`
+
+	// MediumCount is the number of failed checks with medium severity.
+	MediumCount int `json:"mediumCount"`
+
+	// LowCount is the number of failed check with low severity.
+	LowCount int `json:"lowCount"`
 }
 
 // +genclient
@@ -101,16 +106,19 @@ type CheckScope struct {
 
 // Check provides the result of conducting a single audit step.
 type Check struct {
-	ID      string `json:"checkID"`
-	Message string `json:"message"`
+	ID          string   `json:"checkID"`
+	Title       string   `json:"title"`
+	Description string   `json:"description"`
+	Severity    Severity `json:"severity"`
+	Category    string   `json:"category,omitempty"`
+
+	Message string `json:"message,omitempty"`
 
 	// Remediation provides description or links to external resources to remediate failing check.
 	// +optional
 	Remediation string `json:"remediation,omitempty"`
 
-	Success  bool   `json:"success"`
-	Severity string `json:"severity"`
-	Category string `json:"category"`
+	Success bool `json:"success"`
 
 	// Scope indicates the section of config that was audited.
 	// +optional
diff --git a/pkg/apis/aquasecurity/v1alpha1/vulnerability_types.go b/pkg/apis/aquasecurity/v1alpha1/vulnerability_types.go
index 8477a46..c85fdaa 100644
--- a/pkg/apis/aquasecurity/v1alpha1/vulnerability_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/vulnerability_types.go
@@ -13,17 +13,6 @@ const (
 	ClusterVulnerabilityReportsCRName = "clustervulnerabilityreports.aquasecurity.github.io"
 )
 
-type Severity string
-
-const (
-	SeverityCritical Severity = "CRITICAL"
-	SeverityHigh     Severity = "HIGH"
-	SeverityMedium   Severity = "MEDIUM"
-	SeverityLow      Severity = "LOW"
-	SeverityNone     Severity = "NONE"
-	SeverityUnknown  Severity = "UNKNOWN"
-)
-
 // VulnerabilitySummary is a summary of Vulnerability counts grouped by Severity.
 type VulnerabilitySummary struct {
 	// CriticalCount is the number of vulnerabilities with Critical Severity.
diff --git a/pkg/generated/clientset/versioned/clientset.go b/pkg/generated/clientset/versioned/clientset.go
index 9327da2..0dab490 100644
--- a/pkg/generated/clientset/versioned/clientset.go
+++ b/pkg/generated/clientset/versioned/clientset.go
@@ -4,6 +4,7 @@ package versioned
 
 import (
 	"fmt"
+	"net/http"
 
 	aquasecurityv1alpha1 "github.com/aquasecurity/starboard/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1"
 	discovery "k8s.io/client-go/discovery"
@@ -39,22 +40,41 @@ func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 // NewForConfig creates a new Clientset for the given config.
 // If config's RateLimiter is not set and QPS and Burst are acceptable,
 // NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*Clientset, error) {
 	configShallowCopy := *c
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
 	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
 		if configShallowCopy.Burst <= 0 {
 			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
 		}
 		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
 	}
+
 	var cs Clientset
 	var err error
-	cs.aquasecurityV1alpha1, err = aquasecurityv1alpha1.NewForConfig(&configShallowCopy)
+	cs.aquasecurityV1alpha1, err = aquasecurityv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
 
-	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -64,11 +84,11 @@ func NewForConfig(c *rest.Config) (*Clientset, error) {
 // NewForConfigOrDie creates a new Clientset for the given config and
 // panics if there is an error in the config.
 func NewForConfigOrDie(c *rest.Config) *Clientset {
-	var cs Clientset
-	cs.aquasecurityV1alpha1 = aquasecurityv1alpha1.NewForConfigOrDie(c)
-
-	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
-	return &cs
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
 }
 
 // New creates a new Clientset for the given RESTClient.
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go
index 98ad0e2..d19b352 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/aquasecurity_client.go
@@ -3,6 +3,8 @@
 package v1alpha1
 
 import (
+	"net/http"
+
 	v1alpha1 "github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/generated/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
@@ -48,12 +50,28 @@ func (c *AquasecurityV1alpha1Client) VulnerabilityReports(namespace string) Vuln
 }
 
 // NewForConfig creates a new AquasecurityV1alpha1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AquasecurityV1alpha1Client, error) {
 	config := *c
 	if err := setConfigDefaults(&config); err != nil {
 		return nil, err
 	}
-	client, err := rest.RESTClientFor(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new AquasecurityV1alpha1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AquasecurityV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_ciskubebenchreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_ciskubebenchreport.go
index b5876b4..d521367 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_ciskubebenchreport.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_ciskubebenchreport.go
@@ -83,7 +83,7 @@ func (c *FakeCISKubeBenchReports) Update(ctx context.Context, cISKubeBenchReport
 // Delete takes name of the cISKubeBenchReport and deletes it. Returns an error if one occurs.
 func (c *FakeCISKubeBenchReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteAction(ciskubebenchreportsResource, name), &v1alpha1.CISKubeBenchReport{})
+		Invokes(testing.NewRootDeleteActionWithOptions(ciskubebenchreportsResource, name, opts), &v1alpha1.CISKubeBenchReport{})
 	return err
 }
 
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go
index 97711ea..f11e839 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clusterconfigauditreport.go
@@ -83,7 +83,7 @@ func (c *FakeClusterConfigAuditReports) Update(ctx context.Context, clusterConfi
 // Delete takes name of the clusterConfigAuditReport and deletes it. Returns an error if one occurs.
 func (c *FakeClusterConfigAuditReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteAction(clusterconfigauditreportsResource, name), &v1alpha1.ClusterConfigAuditReport{})
+		Invokes(testing.NewRootDeleteActionWithOptions(clusterconfigauditreportsResource, name, opts), &v1alpha1.ClusterConfigAuditReport{})
 	return err
 }
 
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clustervulnerabilityreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clustervulnerabilityreport.go
index ca59786..153122e 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clustervulnerabilityreport.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_clustervulnerabilityreport.go
@@ -83,7 +83,7 @@ func (c *FakeClusterVulnerabilityReports) Update(ctx context.Context, clusterVul
 // Delete takes name of the clusterVulnerabilityReport and deletes it. Returns an error if one occurs.
 func (c *FakeClusterVulnerabilityReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteAction(clustervulnerabilityreportsResource, name), &v1alpha1.ClusterVulnerabilityReport{})
+		Invokes(testing.NewRootDeleteActionWithOptions(clustervulnerabilityreportsResource, name, opts), &v1alpha1.ClusterVulnerabilityReport{})
 	return err
 }
 
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_configauditreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_configauditreport.go
index b8650cd..3ad5c40 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_configauditreport.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_configauditreport.go
@@ -89,7 +89,7 @@ func (c *FakeConfigAuditReports) Update(ctx context.Context, configAuditReport *
 // Delete takes name of the configAuditReport and deletes it. Returns an error if one occurs.
 func (c *FakeConfigAuditReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(configauditreportsResource, c.ns, name), &v1alpha1.ConfigAuditReport{})
+		Invokes(testing.NewDeleteActionWithOptions(configauditreportsResource, c.ns, name, opts), &v1alpha1.ConfigAuditReport{})
 
 	return err
 }
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_kubehunterreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_kubehunterreport.go
index 50e53cf..282eb97 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_kubehunterreport.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_kubehunterreport.go
@@ -83,7 +83,7 @@ func (c *FakeKubeHunterReports) Update(ctx context.Context, kubeHunterReport *v1
 // Delete takes name of the kubeHunterReport and deletes it. Returns an error if one occurs.
 func (c *FakeKubeHunterReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewRootDeleteAction(kubehunterreportsResource, name), &v1alpha1.KubeHunterReport{})
+		Invokes(testing.NewRootDeleteActionWithOptions(kubehunterreportsResource, name, opts), &v1alpha1.KubeHunterReport{})
 	return err
 }
 
diff --git a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_vulnerabilityreport.go b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_vulnerabilityreport.go
index 2d6813f..fcfe89b 100644
--- a/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_vulnerabilityreport.go
+++ b/pkg/generated/clientset/versioned/typed/aquasecurity/v1alpha1/fake/fake_vulnerabilityreport.go
@@ -89,7 +89,7 @@ func (c *FakeVulnerabilityReports) Update(ctx context.Context, vulnerabilityRepo
 // Delete takes name of the vulnerabilityReport and deletes it. Returns an error if one occurs.
 func (c *FakeVulnerabilityReports) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(vulnerabilityreportsResource, c.ns, name), &v1alpha1.VulnerabilityReport{})
+		Invokes(testing.NewDeleteActionWithOptions(vulnerabilityreportsResource, c.ns, name, opts), &v1alpha1.VulnerabilityReport{})
 
 	return err
 }
diff --git a/pkg/plugin/polaris/model.go b/pkg/plugin/polaris/model.go
index b69bcae..b6c1ebe 100644
--- a/pkg/plugin/polaris/model.go
+++ b/pkg/plugin/polaris/model.go
@@ -35,10 +35,17 @@ type ContainerResult struct {
 	Results map[string]Check `json:"Results"`
 }
 
+type Severity string
+
+const (
+	danger  Severity = "danger"
+	warning Severity = "warning"
+)
+
 type Check struct {
-	ID       string `json:"ID"`
-	Message  string `json:"Message"`
-	Success  bool   `json:"Success"`
-	Severity string `json:"Severity"`
-	Category string `json:"Category"`
+	ID       string   `json:"ID"`
+	Message  string   `json:"Message"`
+	Success  bool     `json:"Success"`
+	Severity Severity `json:"Severity"`
+	Category string   `json:"Category"`
 }
diff --git a/pkg/plugin/polaris/plugin.go b/pkg/plugin/polaris/plugin.go
index 1616117..ac7e0b0 100644
--- a/pkg/plugin/polaris/plugin.go
+++ b/pkg/plugin/polaris/plugin.go
@@ -438,7 +438,7 @@ func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsRea
 			ID:       pr.ID,
 			Message:  pr.Message,
 			Success:  pr.Success,
-			Severity: pr.Severity,
+			Severity: p.toSeverity(pr.Severity),
 			Category: pr.Category,
 		}
 		checks = append(checks, check)
@@ -452,7 +452,7 @@ func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsRea
 				ID:       crr.ID,
 				Message:  crr.Message,
 				Success:  crr.Success,
-				Severity: crr.Severity,
+				Severity: p.toSeverity(crr.Severity),
 				Category: crr.Category,
 				Scope: &v1alpha1.CheckScope{
 					Type:  "Container",
@@ -490,6 +490,17 @@ func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsRea
 	}, nil
 }
 
+func (p *plugin) toSeverity(value Severity) v1alpha1.Severity {
+	switch value {
+	case danger:
+		return v1alpha1.SeverityCritical
+	case warning:
+		return v1alpha1.SeverityLow
+	default:
+		return v1alpha1.SeverityUnknown
+	}
+}
+
 func (p *plugin) sourceNameFrom(obj client.Object) string {
 	gvk := obj.GetObjectKind().GroupVersionKind()
 	group := gvk.Group
@@ -509,27 +520,25 @@ func (p *plugin) configAuditSummaryFrom(podChecks []v1alpha1.Check, containerChe
 	var summary v1alpha1.ConfigAuditSummary
 	for _, c := range podChecks {
 		if c.Success {
-			summary.PassCount++
 			continue
 		}
 		switch c.Severity {
-		case v1alpha1.ConfigAuditSeverityDanger:
-			summary.DangerCount++
-		case v1alpha1.ConfigAuditSeverityWarning:
-			summary.WarningCount++
+		case v1alpha1.SeverityCritical:
+			summary.CriticalCount++
+		case v1alpha1.SeverityLow:
+			summary.LowCount++
 		}
 	}
 	for _, checks := range containerChecks {
 		for _, c := range checks {
 			if c.Success {
-				summary.PassCount++
 				continue
 			}
 			switch c.Severity {
-			case v1alpha1.ConfigAuditSeverityDanger:
-				summary.DangerCount++
-			case v1alpha1.ConfigAuditSeverityWarning:
-				summary.WarningCount++
+			case v1alpha1.SeverityCritical:
+				summary.CriticalCount++
+			case v1alpha1.SeverityLow:
+				summary.LowCount++
 			}
 		}
 	}
diff --git a/pkg/report/templates/namespace_report.qtpl b/pkg/report/templates/namespace_report.qtpl
index 2734cd7..698401d 100644
--- a/pkg/report/templates/namespace_report.qtpl
+++ b/pkg/report/templates/namespace_report.qtpl
@@ -87,7 +87,7 @@ Aqua Starboard Namespace Security Report - Namespace: {%s p.Namespace.Name %}
       {% for _, report := range p.Top5FailedChecks %}
       <tr>
         <td>{%s report.ID %}</td>
-        <td>{%s report.Severity %}</td>
+        <td>{%v report.Severity %}</td>
         <td>{%s report.Category %}</td>
         <td>{%d report.AffectedWorkloads %}</td>
       </tr>
diff --git a/pkg/report/templates/namespace_report.qtpl.go b/pkg/report/templates/namespace_report.qtpl.go
index 3b2e1d9..9d09e2b 100644
--- a/pkg/report/templates/namespace_report.qtpl.go
+++ b/pkg/report/templates/namespace_report.qtpl.go
@@ -226,7 +226,7 @@ func (p *NamespaceReport) StreamBody(qw422016 *qt422016.Writer) {
 		qw422016.N().S(`</td>
         <td>`)
 //line pkg/report/templates/namespace_report.qtpl:90
-		qw422016.E().S(report.Severity)
+		qw422016.E().V(report.Severity)
 //line pkg/report/templates/namespace_report.qtpl:90
 		qw422016.N().S(`</td>
         <td>`)
diff --git a/pkg/report/templates/workload_report.qtpl b/pkg/report/templates/workload_report.qtpl
index 63955d2..de11125 100644
--- a/pkg/report/templates/workload_report.qtpl
+++ b/pkg/report/templates/workload_report.qtpl
@@ -1,7 +1,7 @@
 {% import "github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1" %}
 
 {% func (p *WorkloadReport) Title() %}
-Aqua Starboard Workload Security Report - {%s p.Workload.Namespace %}/{%s string(p.Workload.Kind) %}/{%s p.Workload.Name %}
+Aqua Starboard Workload Security Report - {%s p.Workload.Namespace %}/{%v p.Workload.Kind %}/{%s p.Workload.Name %}
 {% endfunc %}
 
 TODO Check if we need that summary logic. If yes move this logic out of HTML templating.
@@ -39,7 +39,7 @@ func (p *WorkloadReport) GetMergedVulnsSummary() (v1alpha1.VulnerabilitySummary)
         <h2 class="text-muted mx-auto">Aqua Starboard Workload Security Report</h2>
       </div>
       <div class="row text-center">
-        <h3 class="text-muted mx-auto">Workload: {%s string(p.Workload.Kind) %}/{%s p.Workload.Name %}</h3>
+        <h3 class="text-muted mx-auto">Workload: {%v p.Workload.Kind %}/{%s p.Workload.Name %}</h3>
       </div>
       <div class="row text-center">
         <h3 class="text-muted mx-auto">Namespace: {%s p.Workload.Namespace %}</h3>
@@ -204,7 +204,7 @@ func (p *WorkloadReport) GetMergedVulnsSummary() (v1alpha1.VulnerabilitySummary)
                           <td>
                             <a target="_blank" href="{%s v.PrimaryLink %}">{%s v.VulnerabilityID %}</a>
                           </td>
-                          <td>{%s string(v.Severity) %}</td>
+                          <td>{%v v.Severity %}</td>
                           <td>{%s v.Resource %}</td>
                           <td>{%s v.InstalledVersion %}</td>
                           <td>{%s v.FixedVersion %}</td>
@@ -247,38 +247,32 @@ func (p *WorkloadReport) GetMergedVulnsSummary() (v1alpha1.VulnerabilitySummary)
                                </div>
                             </div>
                             <div class="row">
-                                {% code
-                                  sumDanger := p.ConfigAuditReport.Report.Summary.DangerCount
-                                  sumWarning := p.ConfigAuditReport.Report.Summary.WarningCount
-                                  sumPass := p.ConfigAuditReport.Report.Summary.PassCount
-                                %}
+                              {% code
+                                sumCritical := p.ConfigAuditReport.Report.Summary.CriticalCount
+                                sumHigh := p.ConfigAuditReport.Report.Summary.HighCount
+                                sumMedium := p.ConfigAuditReport.Report.Summary.MediumCount
+                                sumLow := p.ConfigAuditReport.Report.Summary.LowCount
+                              %}
 
-                                {% if sumDanger > 0 %}
-                                <div class="col text-center p-0 text-danger font-weight-bold">
-                                {% else %}
-                                <div class="col text-center p-0">
-                                {% endif %}
-                                    <p class="mx-auto mb-1">{%d sumDanger %}</p>
-                                    <p class="mx-auto">DANGER</p>
-                                </div>
+                              <div class="col text-center p-0 text-danger font-weight-bold">
+                                <p class="mx-auto mb-1">{%d sumCritical %}</p>
+                                <p class="mx-auto">CRITICAL</p>
+                              </div>
 
-                                {% if sumWarning > 0 %}
-                                <div class="col text-center p-0 text-warning font-weight-bold">
-                                {% else %}
-                                <div class="col text-center p-0">
-                                {% endif %}
-                                    <p class="mx-auto mb-1">{%d sumWarning %}</p>
-                                    <p class="mx-auto">WARNING</p>
-                                </div>
+                              <div class="col text-center p-0 text-danger font-weight-bold">
+                                <p class="mx-auto mb-1">{%d sumHigh %}</p>
+                                <p class="mx-auto">HIGH</p>
+                              </div>
 
-                                {% if sumPass > 0 %}
-                                <div class="col text-center p-0 text-success font-weight-bold">
-                                {% else %}
-                                <div class="col text-center p-0">
-                                {% endif %}
-                                    <p class="mx-auto mb-1">{%d sumPass %}</p>
-                                    <p class="mx-auto ">PASS</p>
-                                </div>
+                              <div class="col text-center p-0 text-warning font-weight-bold">
+                                <p class="mx-auto mb-1">{%d sumMedium %}</p>
+                                <p class="mx-auto">MEDIUM</p>
+                              </div>
+
+                              <div class="col text-center p-0">
+                                <p class="mx-auto mb-1">{%d sumLow %}</p>
+                                <p class="mx-auto">LOW</p>
+                              </div>
                             </div>
                         </div>
                         <!-- Metadata -->
@@ -314,7 +308,7 @@ func (p *WorkloadReport) GetMergedVulnsSummary() (v1alpha1.VulnerabilitySummary)
                                 <tr>
                                   <td>{%v check.Success %}</td>
                                   <td>{%s check.ID %}</td>
-                                  <td>{%s check.Severity %}</td>
+                                  <td>{%v check.Severity %}</td>
                                   <td>{%s check.Category %}</td>
                                 </tr>
                               {% endfor %}
@@ -338,7 +332,7 @@ func (p *WorkloadReport) GetMergedVulnsSummary() (v1alpha1.VulnerabilitySummary)
                                   <tr>
                                     <td>{%v check.Success %}</td>
                                     <td>{%s check.ID %}</td>
-                                    <td>{%s check.Severity %}</td>
+                                    <td>{%v check.Severity %}</td>
                                     <td>{%s check.Category %}</td>
                                   </tr>
                                 {% endfor %}
diff --git a/pkg/report/templates/workload_report.qtpl.go b/pkg/report/templates/workload_report.qtpl.go
index 8a2f6bc..4001bbe 100644
--- a/pkg/report/templates/workload_report.qtpl.go
+++ b/pkg/report/templates/workload_report.qtpl.go
@@ -30,7 +30,7 @@ Aqua Starboard Workload Security Report - `)
 //line pkg/report/templates/workload_report.qtpl:4
 	qw422016.N().S(`/`)
 //line pkg/report/templates/workload_report.qtpl:4
-	qw422016.E().S(string(p.Workload.Kind))
+	qw422016.E().V(p.Workload.Kind)
 //line pkg/report/templates/workload_report.qtpl:4
 	qw422016.N().S(`/`)
 //line pkg/report/templates/workload_report.qtpl:4
@@ -111,7 +111,7 @@ func (p *WorkloadReport) StreamBody(qw422016 *qt422016.Writer) {
       <div class="row text-center">
         <h3 class="text-muted mx-auto">Workload: `)
 //line pkg/report/templates/workload_report.qtpl:42
-	qw422016.E().S(string(p.Workload.Kind))
+	qw422016.E().V(p.Workload.Kind)
 //line pkg/report/templates/workload_report.qtpl:42
 	qw422016.N().S(`/`)
 //line pkg/report/templates/workload_report.qtpl:42
@@ -470,7 +470,7 @@ func (p *WorkloadReport) StreamBody(qw422016 *qt422016.Writer) {
                           </td>
                           <td>`)
 //line pkg/report/templates/workload_report.qtpl:207
-				qw422016.E().S(string(v.Severity))
+				qw422016.E().V(v.Severity)
 //line pkg/report/templates/workload_report.qtpl:207
 				qw422016.N().S(`</td>
                           <td>`)
@@ -555,89 +555,51 @@ func (p *WorkloadReport) StreamBody(qw422016 *qt422016.Writer) {
                                </div>
                             </div>
                             <div class="row">
-                                `)
+                              `)
 //line pkg/report/templates/workload_report.qtpl:251
-		sumDanger := p.ConfigAuditReport.Report.Summary.DangerCount
-		sumWarning := p.ConfigAuditReport.Report.Summary.WarningCount
-		sumPass := p.ConfigAuditReport.Report.Summary.PassCount
+		sumCritical := p.ConfigAuditReport.Report.Summary.CriticalCount
+		sumHigh := p.ConfigAuditReport.Report.Summary.HighCount
+		sumMedium := p.ConfigAuditReport.Report.Summary.MediumCount
+		sumLow := p.ConfigAuditReport.Report.Summary.LowCount
 
-//line pkg/report/templates/workload_report.qtpl:254
+//line pkg/report/templates/workload_report.qtpl:255
 		qw422016.N().S(`
 
-                                `)
-//line pkg/report/templates/workload_report.qtpl:256
-		if sumDanger > 0 {
-//line pkg/report/templates/workload_report.qtpl:256
-			qw422016.N().S(`
-                                <div class="col text-center p-0 text-danger font-weight-bold">
-                                `)
+                              <div class="col text-center p-0 text-danger font-weight-bold">
+                                <p class="mx-auto mb-1">`)
 //line pkg/report/templates/workload_report.qtpl:258
-		} else {
+		qw422016.N().D(sumCritical)
 //line pkg/report/templates/workload_report.qtpl:258
-			qw422016.N().S(`
-                                <div class="col text-center p-0">
-                                `)
-//line pkg/report/templates/workload_report.qtpl:260
-		}
-//line pkg/report/templates/workload_report.qtpl:260
-		qw422016.N().S(`
-                                    <p class="mx-auto mb-1">`)
-//line pkg/report/templates/workload_report.qtpl:261
-		qw422016.N().D(sumDanger)
-//line pkg/report/templates/workload_report.qtpl:261
 		qw422016.N().S(`</p>
-                                    <p class="mx-auto">DANGER</p>
-                                </div>
+                                <p class="mx-auto">CRITICAL</p>
+                              </div>
 
-                                `)
-//line pkg/report/templates/workload_report.qtpl:265
-		if sumWarning > 0 {
-//line pkg/report/templates/workload_report.qtpl:265
-			qw422016.N().S(`
-                                <div class="col text-center p-0 text-warning font-weight-bold">
-                                `)
-//line pkg/report/templates/workload_report.qtpl:267
-		} else {
-//line pkg/report/templates/workload_report.qtpl:267
-			qw422016.N().S(`
-                                <div class="col text-center p-0">
-                                `)
-//line pkg/report/templates/workload_report.qtpl:269
-		}
-//line pkg/report/templates/workload_report.qtpl:269
-		qw422016.N().S(`
-                                    <p class="mx-auto mb-1">`)
-//line pkg/report/templates/workload_report.qtpl:270
-		qw422016.N().D(sumWarning)
-//line pkg/report/templates/workload_report.qtpl:270
+                              <div class="col text-center p-0 text-danger font-weight-bold">
+                                <p class="mx-auto mb-1">`)
+//line pkg/report/templates/workload_report.qtpl:263
+		qw422016.N().D(sumHigh)
+//line pkg/report/templates/workload_report.qtpl:263
 		qw422016.N().S(`</p>
-                                    <p class="mx-auto">WARNING</p>
-                                </div>
+                                <p class="mx-auto">HIGH</p>
+                              </div>
 
-                                `)
-//line pkg/report/templates/workload_report.qtpl:274
-		if sumPass > 0 {
-//line pkg/report/templates/workload_report.qtpl:274
-			qw422016.N().S(`
-                                <div class="col text-center p-0 text-success font-weight-bold">
-                                `)
-//line pkg/report/templates/workload_report.qtpl:276
-		} else {
-//line pkg/report/templates/workload_report.qtpl:276
-			qw422016.N().S(`
-                                <div class="col text-center p-0">
-                                `)
-//line pkg/report/templates/workload_report.qtpl:278
-		}
-//line pkg/report/templates/workload_report.qtpl:278
-		qw422016.N().S(`
-                                    <p class="mx-auto mb-1">`)
-//line pkg/report/templates/workload_report.qtpl:279
-		qw422016.N().D(sumPass)
-//line pkg/report/templates/workload_report.qtpl:279
+                              <div class="col text-center p-0 text-warning font-weight-bold">
+                                <p class="mx-auto mb-1">`)
+//line pkg/report/templates/workload_report.qtpl:268
+		qw422016.N().D(sumMedium)
+//line pkg/report/templates/workload_report.qtpl:268
 		qw422016.N().S(`</p>
-                                    <p class="mx-auto ">PASS</p>
-                                </div>
+                                <p class="mx-auto">MEDIUM</p>
+                              </div>
+
+                              <div class="col text-center p-0">
+                                <p class="mx-auto mb-1">`)
+//line pkg/report/templates/workload_report.qtpl:273
+		qw422016.N().D(sumLow)
+//line pkg/report/templates/workload_report.qtpl:273
+		qw422016.N().S(`</p>
+                                <p class="mx-auto">LOW</p>
+                              </div>
                             </div>
                         </div>
                         <!-- Metadata -->
@@ -651,9 +613,9 @@ func (p *WorkloadReport) StreamBody(qw422016 *qt422016.Writer) {
                                 <div class="col">
                                     <p class="my-0">
                                         Generated at:  `)
-//line pkg/report/templates/workload_report.qtpl:294
+//line pkg/report/templates/workload_report.qtpl:288
 		qw422016.E().S(p.ConfigAuditReport.Report.UpdateTimestamp.Format("2 Jan 2006 15:04:01"))
-//line pkg/report/templates/workload_report.qtpl:294
+//line pkg/report/templates/workload_report.qtpl:288
 		qw422016.N().S(`
                                     </p>
                                 </div>
@@ -674,53 +636,53 @@ func (p *WorkloadReport) StreamBody(qw422016 *qt422016.Writer) {
                             </thead>
                             <tbody>
                               `)
-//line pkg/report/templates/workload_report.qtpl:313
+//line pkg/report/templates/workload_report.qtpl:307
 		for _, check := range p.ConfigAuditReport.Report.PodChecks {
-//line pkg/report/templates/workload_report.qtpl:313
+//line pkg/report/templates/workload_report.qtpl:307
 			qw422016.N().S(`
                                 <tr>
                                   <td>`)
-//line pkg/report/templates/workload_report.qtpl:315
+//line pkg/report/templates/workload_report.qtpl:309
 			qw422016.E().V(check.Success)
-//line pkg/report/templates/workload_report.qtpl:315
+//line pkg/report/templates/workload_report.qtpl:309
 			qw422016.N().S(`</td>
                                   <td>`)
-//line pkg/report/templates/workload_report.qtpl:316
+//line pkg/report/templates/workload_report.qtpl:310
 			qw422016.E().S(check.ID)
-//line pkg/report/templates/workload_report.qtpl:316
+//line pkg/report/templates/workload_report.qtpl:310
 			qw422016.N().S(`</td>
                                   <td>`)
-//line pkg/report/templates/workload_report.qtpl:317
-			qw422016.E().S(check.Severity)
-//line pkg/report/templates/workload_report.qtpl:317
+//line pkg/report/templates/workload_report.qtpl:311
+			qw422016.E().V(check.Severity)
+//line pkg/report/templates/workload_report.qtpl:311
 			qw422016.N().S(`</td>
                                   <td>`)
-//line pkg/report/templates/workload_report.qtpl:318
+//line pkg/report/templates/workload_report.qtpl:312
 			qw422016.E().S(check.Category)
-//line pkg/report/templates/workload_report.qtpl:318
+//line pkg/report/templates/workload_report.qtpl:312
 			qw422016.N().S(`</td>
                                 </tr>
                               `)
-//line pkg/report/templates/workload_report.qtpl:320
+//line pkg/report/templates/workload_report.qtpl:314
 		}
-//line pkg/report/templates/workload_report.qtpl:320
+//line pkg/report/templates/workload_report.qtpl:314
 		qw422016.N().S(`
                             </tbody>
                       </table>
                   </div>
                   `)
-//line pkg/report/templates/workload_report.qtpl:324
+//line pkg/report/templates/workload_report.qtpl:318
 		for container, checks := range p.ConfigAuditReport.Report.ContainerChecks {
-//line pkg/report/templates/workload_report.qtpl:324
+//line pkg/report/templates/workload_report.qtpl:318
 			qw422016.N().S(`
                     <div class="row"><h5 class="text-info" id="ca_container_`)
-//line pkg/report/templates/workload_report.qtpl:325
+//line pkg/report/templates/workload_report.qtpl:319
 			qw422016.E().S(container)
-//line pkg/report/templates/workload_report.qtpl:325
+//line pkg/report/templates/workload_report.qtpl:319
 			qw422016.N().S(`">Container `)
-//line pkg/report/templates/workload_report.qtpl:325
+//line pkg/report/templates/workload_report.qtpl:319
 			qw422016.E().S(container)
-//line pkg/report/templates/workload_report.qtpl:325
+//line pkg/report/templates/workload_report.qtpl:319
 			qw422016.N().S(`</h5></div>
                     <div class="row">
                         <table class="table table-sm table-bordered">
@@ -734,78 +696,78 @@ func (p *WorkloadReport) StreamBody(qw422016 *qt422016.Writer) {
                               </thead>
                               <tbody>
                                 `)
-//line pkg/report/templates/workload_report.qtpl:337
+//line pkg/report/templates/workload_report.qtpl:331
 			for _, check := range checks {
-//line pkg/report/templates/workload_report.qtpl:337
+//line pkg/report/templates/workload_report.qtpl:331
 				qw422016.N().S(`
                                   <tr>
                                     <td>`)
-//line pkg/report/templates/workload_report.qtpl:339
+//line pkg/report/templates/workload_report.qtpl:333
 				qw422016.E().V(check.Success)
-//line pkg/report/templates/workload_report.qtpl:339
+//line pkg/report/templates/workload_report.qtpl:333
 				qw422016.N().S(`</td>
                                     <td>`)
-//line pkg/report/templates/workload_report.qtpl:340
+//line pkg/report/templates/workload_report.qtpl:334
 				qw422016.E().S(check.ID)
-//line pkg/report/templates/workload_report.qtpl:340
+//line pkg/report/templates/workload_report.qtpl:334
 				qw422016.N().S(`</td>
                                     <td>`)
-//line pkg/report/templates/workload_report.qtpl:341
-				qw422016.E().S(check.Severity)
-//line pkg/report/templates/workload_report.qtpl:341
+//line pkg/report/templates/workload_report.qtpl:335
+				qw422016.E().V(check.Severity)
+//line pkg/report/templates/workload_report.qtpl:335
 				qw422016.N().S(`</td>
                                     <td>`)
-//line pkg/report/templates/workload_report.qtpl:342
+//line pkg/report/templates/workload_report.qtpl:336
 				qw422016.E().S(check.Category)
-//line pkg/report/templates/workload_report.qtpl:342
+//line pkg/report/templates/workload_report.qtpl:336
 				qw422016.N().S(`</td>
                                   </tr>
                                 `)
-//line pkg/report/templates/workload_report.qtpl:344
+//line pkg/report/templates/workload_report.qtpl:338
 			}
-//line pkg/report/templates/workload_report.qtpl:344
+//line pkg/report/templates/workload_report.qtpl:338
 			qw422016.N().S(`
                               </tbody>
                         </table>
                     </div>
                   `)
-//line pkg/report/templates/workload_report.qtpl:348
+//line pkg/report/templates/workload_report.qtpl:342
 		}
-//line pkg/report/templates/workload_report.qtpl:348
+//line pkg/report/templates/workload_report.qtpl:342
 		qw422016.N().S(`
                   `)
-//line pkg/report/templates/workload_report.qtpl:349
+//line pkg/report/templates/workload_report.qtpl:343
 	}
-//line pkg/report/templates/workload_report.qtpl:349
+//line pkg/report/templates/workload_report.qtpl:343
 	qw422016.N().S(`
             </div>
         </div>
 `)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 }
 
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 func (p *WorkloadReport) WriteBody(qq422016 qtio422016.Writer) {
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	qw422016 := qt422016.AcquireWriter(qq422016)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	p.StreamBody(qw422016)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	qt422016.ReleaseWriter(qw422016)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 }
 
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 func (p *WorkloadReport) Body() string {
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	qb422016 := qt422016.AcquireByteBuffer()
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	p.WriteBody(qb422016)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	qs422016 := string(qb422016.B)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	qt422016.ReleaseByteBuffer(qb422016)
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 	return qs422016
-//line pkg/report/templates/workload_report.qtpl:352
+//line pkg/report/templates/workload_report.qtpl:346
 }


Test patch:
diff --git a/pkg/configauditreport/io_test.go b/pkg/configauditreport/io_test.go
index 8e1982b..70decc5 100644
--- a/pkg/configauditreport/io_test.go
+++ b/pkg/configauditreport/io_test.go
@@ -34,8 +34,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 8,
-					DangerCount:  3,
+					LowCount:      8,
+					CriticalCount: 3,
 				},
 			},
 		})
@@ -62,8 +62,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 8,
-					DangerCount:  3,
+					LowCount:      8,
+					CriticalCount: 3,
 				},
 			},
 		}, found)
@@ -84,8 +84,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 8,
-					DangerCount:  3,
+					LowCount:      8,
+					CriticalCount: 3,
 				},
 			},
 		}).Build()
@@ -103,8 +103,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 9,
-					DangerCount:  2,
+					LowCount:      9,
+					CriticalCount: 2,
 				},
 			},
 		})
@@ -132,8 +132,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 9,
-					DangerCount:  2,
+					LowCount:      9,
+					CriticalCount: 2,
 				},
 			},
 		}, found)
@@ -260,8 +260,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 8,
-					DangerCount:  3,
+					LowCount:      8,
+					CriticalCount: 3,
 				},
 			},
 		})
@@ -286,8 +286,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 8,
-					DangerCount:  3,
+					LowCount:      8,
+					CriticalCount: 3,
 				},
 			},
 		}, found)
@@ -309,8 +309,8 @@ func TestReadWriter(t *testing.T) {
 					},
 					Report: v1alpha1.ConfigAuditReportData{
 						Summary: v1alpha1.ConfigAuditSummary{
-							WarningCount: 8,
-							DangerCount:  3,
+							LowCount:      8,
+							CriticalCount: 3,
 						},
 					},
 				}).
@@ -327,8 +327,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 9,
-					DangerCount:  2,
+					LowCount:      9,
+					CriticalCount: 2,
 				},
 			},
 		})
@@ -354,8 +354,8 @@ func TestReadWriter(t *testing.T) {
 			},
 			Report: v1alpha1.ConfigAuditReportData{
 				Summary: v1alpha1.ConfigAuditSummary{
-					WarningCount: 9,
-					DangerCount:  2,
+					LowCount:      9,
+					CriticalCount: 2,
 				},
 			},
 		}, found)
diff --git a/pkg/plugin/conftest/plugin.go b/pkg/plugin/conftest/plugin.go
index 848ed21..d95d9ab 100644
--- a/pkg/plugin/conftest/plugin.go
+++ b/pkg/plugin/conftest/plugin.go
@@ -382,33 +382,30 @@ func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsRea
 	err = json.NewDecoder(logsReader).Decode(&checkResults)
 
 	checks := make([]v1alpha1.Check, 0)
-	var successesCount, warningCount, dangerCount int
+	var lowCount, criticalCount int
 
 	for _, cr := range checkResults {
-		// Conftest reportedly returns negative count of passed tests is some cases: https://github.com/open-policy-agent/conftest/issues/464
-		if cr.Successes > 0 {
-			successesCount += cr.Successes
-		}
 
 		for _, warning := range cr.Warnings {
 			checks = append(checks, v1alpha1.Check{
 				ID:       p.getPolicyTitleFromResult(warning),
-				Severity: v1alpha1.ConfigAuditSeverityWarning,
+				Severity: v1alpha1.SeverityLow,
 				Message:  warning.Message,
 				Category: defaultCheckCategory,
 				Success:  false,
 			})
-			warningCount++
+			lowCount++
 		}
 
 		for _, failure := range cr.Failures {
 			checks = append(checks, v1alpha1.Check{
 				ID:       p.getPolicyTitleFromResult(failure),
-				Severity: v1alpha1.ConfigAuditSeverityDanger,
+				Severity: v1alpha1.SeverityCritical,
 				Message:  failure.Message,
 				Category: defaultCheckCategory,
+				Success:  false,
 			})
-			dangerCount++
+			criticalCount++
 		}
 	}
 
@@ -430,9 +427,8 @@ func (p *plugin) ParseConfigAuditReportData(ctx starboard.PluginContext, logsRea
 			Version: version,
 		},
 		Summary: v1alpha1.ConfigAuditSummary{
-			PassCount:    successesCount,
-			WarningCount: warningCount,
-			DangerCount:  dangerCount,
+			CriticalCount: criticalCount,
+			LowCount:      lowCount,
 		},
 		Checks: checks,
 		// TODO Deprecate PodChecks and ContainerChecks in 0.12+
diff --git a/pkg/plugin/conftest/plugin_test.go b/pkg/plugin/conftest/plugin_test.go
index a4c7832..bd91581 100644
--- a/pkg/plugin/conftest/plugin_test.go
+++ b/pkg/plugin/conftest/plugin_test.go
@@ -631,44 +631,43 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 			Version: "v0.30.0",
 		}),
 		"Summary": Equal(v1alpha1.ConfigAuditSummary{
-			DangerCount:  6,
-			WarningCount: 0,
-			PassCount:    2,
+			CriticalCount: 6,
+			LowCount:      0,
 		}),
 		"Checks": MatchAllElements(groupChecksByMessage, Elements{
 			"container kubedns of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container kubedns of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container dnsmasq of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container dnsmasq of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container sidecar of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container sidecar of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container prometheus-to-sd of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container prometheus-to-sd of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container dnsmasq of deployment kube-dns in default namespace should set securityContext.readOnlyRootFilesystem to true": Equal(v1alpha1.Check{
 				ID:       "Root file system is not read-only",
 				Message:  "container dnsmasq of deployment kube-dns in default namespace should set securityContext.readOnlyRootFilesystem to true",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container prometheus-to-sd of deployment kube-dns in default namespace should set resources.requests.cpu": Equal(v1alpha1.Check{
@@ -678,7 +677,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 				ID:       "00000000-0000-0000-0000-000000000001",
 				Message:  "container prometheus-to-sd of deployment kube-dns in default namespace should set resources.requests.cpu",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 		}),
@@ -690,35 +689,35 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container kubedns of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container dnsmasq of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container dnsmasq of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container sidecar of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container sidecar of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container prometheus-to-sd of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop": Equal(v1alpha1.Check{
 				ID:       "Default capabilities: some containers do not drop all",
 				Message:  "container prometheus-to-sd of deployment kube-dns in default namespace should add 'ALL' to securityContext.capabilities.drop",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container dnsmasq of deployment kube-dns in default namespace should set securityContext.readOnlyRootFilesystem to true": Equal(v1alpha1.Check{
 				ID:       "Root file system is not read-only",
 				Message:  "container dnsmasq of deployment kube-dns in default namespace should set securityContext.readOnlyRootFilesystem to true",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 			"container prometheus-to-sd of deployment kube-dns in default namespace should set resources.requests.cpu": Equal(v1alpha1.Check{
@@ -728,7 +727,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 				ID:       "00000000-0000-0000-0000-000000000001",
 				Message:  "container prometheus-to-sd of deployment kube-dns in default namespace should set resources.requests.cpu",
 				Success:  false,
-				Severity: "danger",
+				Severity: v1alpha1.SeverityCritical,
 				Category: "Security",
 			}),
 		}),
diff --git a/pkg/plugin/polaris/plugin_test.go b/pkg/plugin/polaris/plugin_test.go
index c4e6018..6e59725 100644
--- a/pkg/plugin/polaris/plugin_test.go
+++ b/pkg/plugin/polaris/plugin_test.go
@@ -377,21 +377,20 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 		Version: polarisVersion,
 	}))
 	g.Expect(result.Summary).To(Equal(v1alpha1.ConfigAuditSummary{
-		PassCount:    2,
-		DangerCount:  1,
-		WarningCount: 1,
+		CriticalCount: 1,
+		LowCount:      1,
 	}))
 	g.Expect(result.PodChecks).To(ConsistOf(v1alpha1.Check{
 		ID:       "hostIPCSet",
 		Message:  "Host IPC is not configured",
 		Success:  false,
-		Severity: "danger",
+		Severity: v1alpha1.SeverityCritical,
 		Category: "Security",
 	}, v1alpha1.Check{
 		ID:       "hostNetworkSet",
 		Message:  "Host network is not configured",
 		Success:  true,
-		Severity: "warning",
+		Severity: v1alpha1.SeverityLow,
 		Category: "Networking",
 	}))
 	g.Expect(result.ContainerChecks).To(HaveLen(1))
@@ -399,7 +398,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 		ID:       "cpuLimitsMissing",
 		Message:  "CPU limits are set",
 		Success:  false,
-		Severity: "warning",
+		Severity: v1alpha1.SeverityLow,
 		Category: "Resources",
 		Scope: &v1alpha1.CheckScope{
 			Type:  "Container",
@@ -409,7 +408,7 @@ func TestPlugin_ParseConfigAuditReportData(t *testing.T) {
 		ID:       "cpuRequestsMissing",
 		Message:  "CPU requests are set",
 		Success:  true,
-		Severity: "warning",
+		Severity: v1alpha1.SeverityLow,
 		Category: "Resources",
 		Scope: &v1alpha1.CheckScope{
 			Type:  "Container",