Repository: aquasecurity/starboard
Pull request #477 (2021-04-07 07:04:56)

refactor: Move constants to starboard package
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=h1) Report
> Merging [#477](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=desc) (375068f) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/26dbd33609f71c40e0e98e2a8d5d2eeec2601a59?el=desc) (26dbd33) will **decrease** coverage by `34.46%`.
> The diff coverage is `32.72%`.

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/477/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb)](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=tree)

```diff
@@             Coverage Diff             @@
##             main     #477       +/-   ##
===========================================
- Coverage   69.42%   34.95%   -34.47%     
===========================================
  Files          62       61        -1     
  Lines        3984     3856      -128     
===========================================
- Hits         2766     1348     -1418     
- Misses        924     2429     +1505     
+ Partials      294       79      -215     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-82.20%)` | :arrow_down: |
| [pkg/kubebench/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL2t1YmViZW5jaC9zY2FubmVyLmdv) | `62.67% <0.00%> (-27.65%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-65.06%)` | :arrow_down: |
| [pkg/operator/controller/configauditreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY29uZmlnYXVkaXRyZXBvcnQuZ28=) | `0.00% <0.00%> (-66.38%)` | :arrow_down: |
| [pkg/operator/controller/plugins\_config.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvcGx1Z2luc19jb25maWcuZ28=) | `0.00% <0.00%> (-21.06%)` | :arrow_down: |
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-69.14%)` | :arrow_down: |
| [pkg/operator/predicate/predicate.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL29wZXJhdG9yL3ByZWRpY2F0ZS9wcmVkaWNhdGUuZ28=) | `68.00% <0.00%> (-24.00%)` | :arrow_down: |
| [pkg/report/html.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL3JlcG9ydC9odG1sLmdv) | `19.56% <0.00%> (ø)` | |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-74.23%)` | :arrow_down: |
| [itest/matcher/matcher.go](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree#diff-aXRlc3QvbWF0Y2hlci9tYXRjaGVyLmdv) | `84.00% <100.00%> (ø)` | |
| ... and [50 more](https://codecov.io/gh/aquasecurity/starboard/pull/477/diff?src=pr&el=tree-more) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=footer). Last update [26dbd33...375068f](https://codecov.io/gh/aquasecurity/starboard/pull/477?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/pkg/configauditreport/builder.go b/pkg/configauditreport/builder.go
index 63d5cd0..9829a16 100644
--- a/pkg/configauditreport/builder.go
+++ b/pkg/configauditreport/builder.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -69,17 +70,17 @@ func (b *builder) Get() (v1alpha1.ConfigAuditReport, error) {
 	}
 
 	labels := map[string]string{
-		kube.LabelResourceKind:      kind,
-		kube.LabelResourceName:      b.controller.GetName(),
-		kube.LabelResourceNamespace: b.controller.GetNamespace(),
+		starboard.LabelResourceKind:      kind,
+		starboard.LabelResourceName:      b.controller.GetName(),
+		starboard.LabelResourceNamespace: b.controller.GetNamespace(),
 	}
 
 	if b.hash != "" {
-		labels[kube.LabelPodSpecHash] = b.hash
+		labels[starboard.LabelPodSpecHash] = b.hash
 	}
 
 	if b.configHash != "" {
-		labels[kube.LabelPluginConfigHash] = b.configHash
+		labels[starboard.LabelPluginConfigHash] = b.configHash
 	}
 
 	reportName, err := b.reportName()
diff --git a/pkg/configauditreport/io.go b/pkg/configauditreport/io.go
index 05bb549..eb2f955 100644
--- a/pkg/configauditreport/io.go
+++ b/pkg/configauditreport/io.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -76,9 +77,9 @@ func (r *readWriter) FindByOwner(ctx context.Context, owner kube.Object) (*v1alp
 	var list v1alpha1.ConfigAuditReportList
 
 	err := r.List(ctx, &list, client.MatchingLabels{
-		kube.LabelResourceKind:      string(owner.Kind),
-		kube.LabelResourceNamespace: owner.Namespace,
-		kube.LabelResourceName:      owner.Name,
+		starboard.LabelResourceKind:      string(owner.Kind),
+		starboard.LabelResourceNamespace: owner.Namespace,
+		starboard.LabelResourceName:      owner.Name,
 	}, client.InNamespace(owner.Namespace))
 	if err != nil {
 		return nil, err
diff --git a/pkg/configauditreport/scanner.go b/pkg/configauditreport/scanner.go
index 8ea354b..a2563b9 100644
--- a/pkg/configauditreport/scanner.go
+++ b/pkg/configauditreport/scanner.go
@@ -110,9 +110,9 @@ func (s *Scanner) getScanJob(obj client.Object) (*batchv1.Job, []*corev1.Secret,
 			Name:      s.GenerateID(),
 			Namespace: starboard.NamespaceName,
 			Labels: map[string]string{
-				kube.LabelResourceKind:      obj.GetObjectKind().GroupVersionKind().Kind,
-				kube.LabelResourceName:      obj.GetName(),
-				kube.LabelResourceNamespace: obj.GetNamespace(),
+				starboard.LabelResourceKind:      obj.GetObjectKind().GroupVersionKind().Kind,
+				starboard.LabelResourceName:      obj.GetName(),
+				starboard.LabelResourceNamespace: obj.GetNamespace(),
 			},
 		},
 		Spec: batchv1.JobSpec{
@@ -122,9 +122,9 @@ func (s *Scanner) getScanJob(obj client.Object) (*batchv1.Job, []*corev1.Secret,
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
-						kube.LabelResourceKind:      obj.GetObjectKind().GroupVersionKind().Kind,
-						kube.LabelResourceName:      obj.GetName(),
-						kube.LabelResourceNamespace: obj.GetNamespace(),
+						starboard.LabelResourceKind:      obj.GetObjectKind().GroupVersionKind().Kind,
+						starboard.LabelResourceName:      obj.GetName(),
+						starboard.LabelResourceNamespace: obj.GetNamespace(),
 					},
 				},
 				Spec: jobSpec,
diff --git a/pkg/kube/object.go b/pkg/kube/object.go
index c7a7ae7..aca64d7 100644
--- a/pkg/kube/object.go
+++ b/pkg/kube/object.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
@@ -61,16 +62,16 @@ func IsBuiltInWorkload(controller *metav1.OwnerReference) bool {
 }
 
 func ObjectFromLabelsSet(set labels.Set) (Object, error) {
-	if !set.Has(LabelResourceKind) {
-		return Object{}, fmt.Errorf("required label does not exist: %s", LabelResourceKind)
+	if !set.Has(starboard.LabelResourceKind) {
+		return Object{}, fmt.Errorf("required label does not exist: %s", starboard.LabelResourceKind)
 	}
-	if !set.Has(LabelResourceName) {
-		return Object{}, fmt.Errorf("required label does not exist: %s", LabelResourceName)
+	if !set.Has(starboard.LabelResourceName) {
+		return Object{}, fmt.Errorf("required label does not exist: %s", starboard.LabelResourceName)
 	}
 	return Object{
-		Kind:      Kind(set.Get(LabelResourceKind)),
-		Name:      set.Get(LabelResourceName),
-		Namespace: set.Get(LabelResourceNamespace),
+		Kind:      Kind(set.Get(starboard.LabelResourceKind)),
+		Name:      set.Get(starboard.LabelResourceName),
+		Namespace: set.Get(starboard.LabelResourceNamespace),
 	}, nil
 }
 
diff --git a/pkg/kube/resources.go b/pkg/kube/resources.go
index b826cb0..437bd60 100644
--- a/pkg/kube/resources.go
+++ b/pkg/kube/resources.go
@@ -5,6 +5,7 @@ import (
 	"hash"
 	"hash/fnv"
 
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/davecgh/go-spew/spew"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -29,13 +30,13 @@ func GetContainerImagesFromJob(job *batchv1.Job) (ContainerImages, error) {
 	var containerImagesAsJSON string
 	var ok bool
 
-	if containerImagesAsJSON, ok = job.Annotations[AnnotationContainerImages]; !ok {
-		return nil, fmt.Errorf("required annotation not set: %s", AnnotationContainerImages)
+	if containerImagesAsJSON, ok = job.Annotations[starboard.AnnotationContainerImages]; !ok {
+		return nil, fmt.Errorf("required annotation not set: %s", starboard.AnnotationContainerImages)
 	}
 	containerImages := ContainerImages{}
 	err := containerImages.FromJSON(containerImagesAsJSON)
 	if err != nil {
-		return nil, fmt.Errorf("parsing annotation: %s: %w", AnnotationContainerImages, err)
+		return nil, fmt.Errorf("parsing annotation: %s: %w", starboard.AnnotationContainerImages, err)
 	}
 	return containerImages, nil
 }
diff --git a/pkg/kube/starboard.go b/pkg/kube/starboard.go
index 57912fd..6b47673 100644
--- a/pkg/kube/starboard.go
+++ b/pkg/kube/starboard.go
@@ -4,30 +4,6 @@ import (
 	"time"
 )
 
-const (
-	// TODO I'm wondering if we should rename starboard.resource.* labels to starboard.object.*
-	// TODO In Kubernetes API terminology a resource is usually lowercase, plural word (e.g. pods) identifying a set of
-	// TODO HTTP endpoints (paths) exposing the CRUD semantics of a certain object type in the system
-	LabelResourceKind      = "starboard.resource.kind"
-	LabelResourceName      = "starboard.resource.name"
-	LabelResourceNamespace = "starboard.resource.namespace"
-
-	LabelContainerName    = "starboard.container.name"
-	LabelPodSpecHash      = "pod-spec-hash"
-	LabelPluginConfigHash = "plugin-config-hash"
-
-	LabelConfigAuditReportScan   = "configAuditReport.scanner"
-	LabelVulnerabilityReportScan = "vulnerabilityReport.scanner"
-	LabelKubeBenchReportScan     = "kubeBenchReport.scanner"
-
-	LabelK8SAppManagedBy = "app.kubernetes.io/managed-by"
-	AppStarboardOperator = "starboard-operator"
-)
-
-const (
-	AnnotationContainerImages = "starboard.container-images"
-)
-
 // ScannerOpts holds configuration of the vulnerability Scanner.
 type ScannerOpts struct {
 	ScanJobTimeout time.Duration
diff --git a/pkg/kubebench/scanner.go b/pkg/kubebench/scanner.go
index 2a1e6d4..147a8f6 100644
--- a/pkg/kubebench/scanner.go
+++ b/pkg/kubebench/scanner.go
@@ -95,8 +95,8 @@ func (s *Scanner) Scan(ctx context.Context, node corev1.Node) (v1alpha1.CISKubeB
 		ObjectMeta: metav1.ObjectMeta{
 			Name: node.Name,
 			Labels: map[string]string{
-				kube.LabelResourceKind: string(kube.KindNode),
-				kube.LabelResourceName: node.Name,
+				starboard.LabelResourceKind: string(kube.KindNode),
+				starboard.LabelResourceName: node.Name,
 			},
 		},
 		Report: output,
@@ -121,8 +121,8 @@ func (s *Scanner) prepareKubeBenchJob(node corev1.Node) (*batchv1.Job, error) {
 			Name:      uuid.New().String(),
 			Namespace: starboard.NamespaceName,
 			Labels: labels.Set{
-				kube.LabelResourceKind: string(kube.KindNode),
-				kube.LabelResourceName: node.Name,
+				starboard.LabelResourceKind: string(kube.KindNode),
+				starboard.LabelResourceName: node.Name,
 			},
 		},
 		Spec: batchv1.JobSpec{
@@ -132,8 +132,8 @@ func (s *Scanner) prepareKubeBenchJob(node corev1.Node) (*batchv1.Job, error) {
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: labels.Set{
-						kube.LabelResourceKind: string(kube.KindNode),
-						kube.LabelResourceName: node.Name,
+						starboard.LabelResourceKind: string(kube.KindNode),
+						starboard.LabelResourceName: node.Name,
 					},
 				},
 				Spec: templateSpec,
diff --git a/pkg/kubehunter/writer.go b/pkg/kubehunter/writer.go
index 9d1aa68..0ac490a 100644
--- a/pkg/kubehunter/writer.go
+++ b/pkg/kubehunter/writer.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/generated/clientset/versioned"
-	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -34,8 +34,8 @@ func (w *writer) Write(ctx context.Context, report v1alpha1.KubeHunterOutput, cl
 		ObjectMeta: metav1.ObjectMeta{
 			Name: cluster,
 			Labels: map[string]string{
-				kube.LabelResourceKind: "Cluster",
-				kube.LabelResourceName: cluster,
+				starboard.LabelResourceKind: "Cluster",
+				starboard.LabelResourceName: cluster,
 			},
 		},
 		Report: report,
diff --git a/pkg/operator/controller/ciskubebenchreport.go b/pkg/operator/controller/ciskubebenchreport.go
index a7a8033..e8f7745 100644
--- a/pkg/operator/controller/ciskubebenchreport.go
+++ b/pkg/operator/controller/ciskubebenchreport.go
@@ -1,6 +1,8 @@
 package controller
 
 import (
+	. "github.com/aquasecurity/starboard/pkg/operator/predicate"
+
 	"context"
 	"fmt"
 
@@ -8,7 +10,7 @@ import (
 	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/kubebench"
 	"github.com/aquasecurity/starboard/pkg/operator/etc"
-	. "github.com/aquasecurity/starboard/pkg/operator/predicate"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/go-logr/logr"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -162,10 +164,10 @@ func (r *CISKubeBenchReportReconciler) newScanJob(node *corev1.Node) (*batchv1.J
 			Name:      r.getScanJobName(node),
 			Namespace: r.Config.Namespace,
 			Labels: labels.Set{
-				kube.LabelResourceKind:        string(kube.KindNode),
-				kube.LabelResourceName:        node.Name,
-				kube.LabelK8SAppManagedBy:     kube.AppStarboardOperator,
-				kube.LabelKubeBenchReportScan: "true",
+				starboard.LabelResourceKind:        string(kube.KindNode),
+				starboard.LabelResourceName:        node.Name,
+				starboard.LabelK8SAppManagedBy:     starboard.AppStarboardOperator,
+				starboard.LabelKubeBenchReportScan: "true",
 			},
 		},
 		Spec: batchv1.JobSpec{
@@ -175,10 +177,10 @@ func (r *CISKubeBenchReportReconciler) newScanJob(node *corev1.Node) (*batchv1.J
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: labels.Set{
-						kube.LabelResourceKind:        string(kube.KindNode),
-						kube.LabelResourceName:        node.Name,
-						kube.LabelK8SAppManagedBy:     kube.AppStarboardOperator,
-						kube.LabelKubeBenchReportScan: "true",
+						starboard.LabelResourceKind:        string(kube.KindNode),
+						starboard.LabelResourceName:        node.Name,
+						starboard.LabelK8SAppManagedBy:     starboard.AppStarboardOperator,
+						starboard.LabelKubeBenchReportScan: "true",
 					},
 				},
 				Spec: templateSpec,
@@ -274,8 +276,8 @@ func (r *CISKubeBenchReportReconciler) processCompleteScanJob(ctx context.Contex
 		ObjectMeta: metav1.ObjectMeta{
 			Name: node.Name,
 			Labels: map[string]string{
-				kube.LabelResourceKind: string(kube.KindNode),
-				kube.LabelResourceName: node.Name,
+				starboard.LabelResourceKind: string(kube.KindNode),
+				starboard.LabelResourceName: node.Name,
 			},
 		},
 		Report: output,
diff --git a/pkg/operator/controller/configauditreport.go b/pkg/operator/controller/configauditreport.go
index 3332a85..e5fbd52 100644
--- a/pkg/operator/controller/configauditreport.go
+++ b/pkg/operator/controller/configauditreport.go
@@ -199,13 +199,14 @@ func (r *ConfigAuditReportReconciler) reconcileWorkload(workloadKind kube.Kind)
 }
 
 func (r *ConfigAuditReportReconciler) hasReport(ctx context.Context, owner kube.Object, podSpecHash string, pluginConfigHash string) (bool, error) {
+	// TODO FindByOwner should accept optional label selector to further narrow down search results
 	report, err := r.ReadWriter.FindByOwner(ctx, owner)
 	if err != nil {
 		return false, err
 	}
 	if report != nil {
-		return report.Labels[kube.LabelPodSpecHash] == podSpecHash &&
-			report.Labels[kube.LabelPluginConfigHash] == pluginConfigHash, nil
+		return report.Labels[starboard.LabelPodSpecHash] == podSpecHash &&
+			report.Labels[starboard.LabelPluginConfigHash] == pluginConfigHash, nil
 	}
 	return false, nil
 }
@@ -220,7 +221,7 @@ func (r *ConfigAuditReportReconciler) hasActiveScanJob(ctx context.Context, owne
 		}
 		return false, nil, fmt.Errorf("getting pod from cache: %w", err)
 	}
-	if job.Labels[kube.LabelPodSpecHash] == hash {
+	if job.Labels[starboard.LabelPodSpecHash] == hash {
 		return true, job, nil
 	}
 	return false, nil, nil
@@ -247,13 +248,13 @@ func (r *ConfigAuditReportReconciler) getScanJob(workload kube.Object, obj clien
 			Name:      r.getScanJobName(workload),
 			Namespace: r.Config.Namespace,
 			Labels: map[string]string{
-				kube.LabelResourceKind:          string(workload.Kind),
-				kube.LabelResourceName:          workload.Name,
-				kube.LabelResourceNamespace:     workload.Namespace,
-				kube.LabelK8SAppManagedBy:       kube.AppStarboardOperator,
-				kube.LabelPodSpecHash:           podSpecHash,
-				kube.LabelPluginConfigHash:      configHash,
-				kube.LabelConfigAuditReportScan: "true",
+				starboard.LabelResourceKind:          string(workload.Kind),
+				starboard.LabelResourceName:          workload.Name,
+				starboard.LabelResourceNamespace:     workload.Namespace,
+				starboard.LabelK8SAppManagedBy:       starboard.AppStarboardOperator,
+				starboard.LabelPodSpecHash:           podSpecHash,
+				starboard.LabelPluginConfigHash:      configHash,
+				starboard.LabelConfigAuditReportScan: "true",
 			},
 		},
 		Spec: batchv1.JobSpec{
@@ -263,13 +264,13 @@ func (r *ConfigAuditReportReconciler) getScanJob(workload kube.Object, obj clien
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
-						kube.LabelResourceKind:          string(workload.Kind),
-						kube.LabelResourceName:          workload.Name,
-						kube.LabelResourceNamespace:     workload.Namespace,
-						kube.LabelK8SAppManagedBy:       kube.AppStarboardOperator,
-						kube.LabelPodSpecHash:           podSpecHash,
-						kube.LabelPluginConfigHash:      configHash,
-						kube.LabelConfigAuditReportScan: "true",
+						starboard.LabelResourceKind:          string(workload.Kind),
+						starboard.LabelResourceName:          workload.Name,
+						starboard.LabelResourceNamespace:     workload.Namespace,
+						starboard.LabelK8SAppManagedBy:       starboard.AppStarboardOperator,
+						starboard.LabelPodSpecHash:           podSpecHash,
+						starboard.LabelPluginConfigHash:      configHash,
+						starboard.LabelConfigAuditReportScan: "true",
 					},
 				},
 				Spec: jobSpec,
@@ -327,13 +328,13 @@ func (r *ConfigAuditReportReconciler) processCompleteScanJob(ctx context.Context
 		return err
 	}
 
-	podSpecHash, ok := job.Labels[kube.LabelPodSpecHash]
+	podSpecHash, ok := job.Labels[starboard.LabelPodSpecHash]
 	if !ok {
-		return fmt.Errorf("expected label %s not set", kube.LabelPodSpecHash)
+		return fmt.Errorf("expected label %s not set", starboard.LabelPodSpecHash)
 	}
-	pluginConfigHash, ok := job.Labels[kube.LabelPluginConfigHash]
+	pluginConfigHash, ok := job.Labels[starboard.LabelPluginConfigHash]
 	if !ok {
-		return fmt.Errorf("expected label %s not set", kube.LabelPluginConfigHash)
+		return fmt.Errorf("expected label %s not set", starboard.LabelPluginConfigHash)
 	}
 
 	hasConfigAuditReport, err := r.hasReport(ctx, owner, podSpecHash, pluginConfigHash)
diff --git a/pkg/operator/controller/limit_checker.go b/pkg/operator/controller/limit_checker.go
index 0cf4cef..a75f5ff 100644
--- a/pkg/operator/controller/limit_checker.go
+++ b/pkg/operator/controller/limit_checker.go
@@ -2,8 +2,8 @@ package controller
 
 import (
 	"context"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 
-	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/operator/etc"
 	batchv1 "k8s.io/api/batch/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -37,7 +37,7 @@ func (c *checker) Check(ctx context.Context) (bool, int, error) {
 func (c *checker) countScanJobs(ctx context.Context) (int, error) {
 	var scanJobs batchv1.JobList
 	err := c.client.List(ctx, &scanJobs, client.MatchingLabels{
-		kube.LabelK8SAppManagedBy: kube.AppStarboardOperator,
+		starboard.LabelK8SAppManagedBy: starboard.AppStarboardOperator,
 	}, client.InNamespace(c.config.Namespace))
 	if err != nil {
 		return 0, err
diff --git a/pkg/operator/controller/plugins_config.go b/pkg/operator/controller/plugins_config.go
index 40857ff..098f648 100644
--- a/pkg/operator/controller/plugins_config.go
+++ b/pkg/operator/controller/plugins_config.go
@@ -8,7 +8,6 @@ import (
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/configauditreport"
 	"github.com/aquasecurity/starboard/pkg/ext"
-	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/operator/etc"
 	"github.com/aquasecurity/starboard/pkg/operator/predicate"
 	"github.com/aquasecurity/starboard/pkg/starboard"
@@ -41,7 +40,7 @@ func (r *PluginsConfigReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 	log := r.Logger.WithValues("configMap", req.NamespacedName)
 
 	// TODO Use Predicate instead
-	if req.Name != strings.ToLower("starboard-"+r.PluginContext.GetName()+"config") {
+	if req.Name != "starboard-"+strings.ToLower(r.PluginContext.GetName())+"-config" {
 		return ctrl.Result{}, nil
 	}
 
@@ -61,7 +60,7 @@ func (r *PluginsConfigReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 		return ctrl.Result{}, err
 	}
 
-	labelSelector, err := labels.Parse(fmt.Sprintf("%s != %s", kube.LabelPluginConfigHash, configHash))
+	labelSelector, err := labels.Parse(fmt.Sprintf("%s != %s", starboard.LabelPluginConfigHash, configHash))
 	if err != nil {
 		return ctrl.Result{}, err
 	}
diff --git a/pkg/operator/controller/vulnerabilityreport.go b/pkg/operator/controller/vulnerabilityreport.go
index 6171b2f..c14911c 100644
--- a/pkg/operator/controller/vulnerabilityreport.go
+++ b/pkg/operator/controller/vulnerabilityreport.go
@@ -1,6 +1,8 @@
 package controller
 
 import (
+	. "github.com/aquasecurity/starboard/pkg/operator/predicate"
+
 	"context"
 	"fmt"
 	"reflect"
@@ -9,7 +11,7 @@ import (
 	"github.com/aquasecurity/starboard/pkg/docker"
 	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/operator/etc"
-	. "github.com/aquasecurity/starboard/pkg/operator/predicate"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/aquasecurity/starboard/pkg/vulnerabilityreport"
 	"github.com/go-logr/logr"
 	appsv1 "k8s.io/api/apps/v1"
@@ -163,6 +165,7 @@ func (r *VulnerabilityReportReconciler) reconcileWorkload(workloadKind kube.Kind
 }
 
 func (r *VulnerabilityReportReconciler) hasVulnerabilityReports(ctx context.Context, owner kube.Object, hash string, images kube.ContainerImages) (bool, error) {
+	// TODO FindByOwner should accept optional label selector to further narrow down search results
 	list, err := r.FindByOwner(ctx, owner)
 	if err != nil {
 		return false, err
@@ -170,8 +173,8 @@ func (r *VulnerabilityReportReconciler) hasVulnerabilityReports(ctx context.Cont
 
 	actual := map[string]bool{}
 	for _, report := range list {
-		if containerName, ok := report.Labels[kube.LabelContainerName]; ok {
-			if hash == report.Labels[kube.LabelPodSpecHash] {
+		if containerName, ok := report.Labels[starboard.LabelContainerName]; ok {
+			if hash == report.Labels[starboard.LabelPodSpecHash] {
 				actual[containerName] = true
 			}
 		}
@@ -195,7 +198,7 @@ func (r *VulnerabilityReportReconciler) hasActiveScanJob(ctx context.Context, ow
 		}
 		return false, nil, fmt.Errorf("getting job from cache: %w", err)
 	}
-	if job.Labels[kube.LabelPodSpecHash] == hash {
+	if job.Labels[starboard.LabelPodSpecHash] == hash {
 		return true, job, nil
 	}
 	return false, nil, nil
@@ -234,15 +237,15 @@ func (r *VulnerabilityReportReconciler) submitScanJob(ctx context.Context, spec
 			Name:      jobName,
 			Namespace: r.Config.Namespace,
 			Labels: map[string]string{
-				kube.LabelResourceKind:            string(owner.Kind),
-				kube.LabelResourceName:            owner.Name,
-				kube.LabelResourceNamespace:       owner.Namespace,
-				kube.LabelPodSpecHash:             hash,
-				kube.LabelK8SAppManagedBy:         kube.AppStarboardOperator,
-				kube.LabelVulnerabilityReportScan: "true",
+				starboard.LabelResourceKind:            string(owner.Kind),
+				starboard.LabelResourceName:            owner.Name,
+				starboard.LabelResourceNamespace:       owner.Namespace,
+				starboard.LabelPodSpecHash:             hash,
+				starboard.LabelK8SAppManagedBy:         starboard.AppStarboardOperator,
+				starboard.LabelVulnerabilityReportScan: "true",
 			},
 			Annotations: map[string]string{
-				kube.AnnotationContainerImages: containerImagesAsJSON,
+				starboard.AnnotationContainerImages: containerImagesAsJSON,
 			},
 		},
 		Spec: batchv1.JobSpec{
@@ -252,12 +255,12 @@ func (r *VulnerabilityReportReconciler) submitScanJob(ctx context.Context, spec
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
-						kube.LabelResourceKind:            string(owner.Kind),
-						kube.LabelResourceName:            owner.Name,
-						kube.LabelResourceNamespace:       owner.Namespace,
-						kube.LabelPodSpecHash:             hash,
-						kube.LabelK8SAppManagedBy:         kube.AppStarboardOperator,
-						kube.LabelVulnerabilityReportScan: "true",
+						starboard.LabelResourceKind:            string(owner.Kind),
+						starboard.LabelResourceName:            owner.Name,
+						starboard.LabelResourceNamespace:       owner.Namespace,
+						starboard.LabelPodSpecHash:             hash,
+						starboard.LabelK8SAppManagedBy:         starboard.AppStarboardOperator,
+						starboard.LabelVulnerabilityReportScan: "true",
 					},
 				},
 				Spec: templateSpec,
@@ -347,9 +350,9 @@ func (r *VulnerabilityReportReconciler) processCompleteScanJob(ctx context.Conte
 		return fmt.Errorf("getting container images: %w", err)
 	}
 
-	hash, ok := job.Labels[kube.LabelPodSpecHash]
+	hash, ok := job.Labels[starboard.LabelPodSpecHash]
 	if !ok {
-		return fmt.Errorf("expected label %s not set", kube.LabelPodSpecHash)
+		return fmt.Errorf("expected label %s not set", starboard.LabelPodSpecHash)
 	}
 
 	log.V(1).Info("Resolving workload properties",
diff --git a/pkg/operator/predicate/predicate.go b/pkg/operator/predicate/predicate.go
index 2fb43af..3dd487b 100644
--- a/pkg/operator/predicate/predicate.go
+++ b/pkg/operator/predicate/predicate.go
@@ -2,8 +2,8 @@ package predicate
 
 import (
 	"github.com/aquasecurity/starboard/pkg/ext"
-	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/operator/etc"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	batchv1 "k8s.io/api/batch/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/event"
@@ -78,21 +78,21 @@ var JobHasAnyCondition = predicate.NewPredicateFuncs(func(obj client.Object) boo
 })
 
 var IsVulnerabilityReportScan = predicate.NewPredicateFuncs(func(obj client.Object) bool {
-	if _, ok := obj.GetLabels()[kube.LabelVulnerabilityReportScan]; ok {
+	if _, ok := obj.GetLabels()[starboard.LabelVulnerabilityReportScan]; ok {
 		return true
 	}
 	return false
 })
 
 var IsConfigAuditReportScan = predicate.NewPredicateFuncs(func(obj client.Object) bool {
-	if _, ok := obj.GetLabels()[kube.LabelConfigAuditReportScan]; ok {
+	if _, ok := obj.GetLabels()[starboard.LabelConfigAuditReportScan]; ok {
 		return true
 	}
 	return false
 })
 
 var IsKubeBenchReportScan = predicate.NewPredicateFuncs(func(obj client.Object) bool {
-	if _, ok := obj.GetLabels()[kube.LabelKubeBenchReportScan]; ok {
+	if _, ok := obj.GetLabels()[starboard.LabelKubeBenchReportScan]; ok {
 		return true
 	}
 	return false
diff --git a/pkg/report/html.go b/pkg/report/html.go
index 5524dad..7f4164f 100644
--- a/pkg/report/html.go
+++ b/pkg/report/html.go
@@ -12,6 +12,7 @@ import (
 	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/kubebench"
 	"github.com/aquasecurity/starboard/pkg/report/templates"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/aquasecurity/starboard/pkg/vulnerabilityreport"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -44,7 +45,7 @@ func (h *workloadReporter) RetrieveData(workload kube.Object) (templates.Workloa
 
 	vulnsReports := map[string]v1alpha1.VulnerabilityScanResult{}
 	for _, vulnerabilityReport := range vulnerabilityReports {
-		containerName, ok := vulnerabilityReport.Labels[kube.LabelContainerName]
+		containerName, ok := vulnerabilityReport.Labels[starboard.LabelContainerName]
 		if !ok {
 			continue
 		}
diff --git a/pkg/starboard/constants.go b/pkg/starboard/constants.go
index 081c7df..370dc8b 100644
--- a/pkg/starboard/constants.go
+++ b/pkg/starboard/constants.go
@@ -17,3 +17,23 @@ const (
 	// configuration.
 	SecretName = "starboard"
 )
+
+const (
+	LabelResourceKind      = "starboard.resource.kind"
+	LabelResourceName      = "starboard.resource.name"
+	LabelResourceNamespace = "starboard.resource.namespace"
+	LabelContainerName     = "starboard.container.name"
+	LabelPodSpecHash       = "pod-spec-hash"
+	LabelPluginConfigHash  = "plugin-config-hash"
+
+	LabelConfigAuditReportScan   = "configAuditReport.scanner"
+	LabelVulnerabilityReportScan = "vulnerabilityReport.scanner"
+	LabelKubeBenchReportScan     = "kubeBenchReport.scanner"
+
+	LabelK8SAppManagedBy = "app.kubernetes.io/managed-by"
+	AppStarboardOperator = "starboard-operator"
+)
+
+const (
+	AnnotationContainerImages = "starboard.container-images"
+)
diff --git a/pkg/vulnerabilityreport/builder.go b/pkg/vulnerabilityreport/builder.go
index 46e638a..fe5df6c 100644
--- a/pkg/vulnerabilityreport/builder.go
+++ b/pkg/vulnerabilityreport/builder.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -69,14 +70,14 @@ func (b *builder) Get() (v1alpha1.VulnerabilityReport, error) {
 	}
 
 	labels := map[string]string{
-		kube.LabelResourceKind:      kind,
-		kube.LabelResourceName:      b.owner.GetName(),
-		kube.LabelResourceNamespace: b.owner.GetNamespace(),
-		kube.LabelContainerName:     b.container,
+		starboard.LabelResourceKind:      kind,
+		starboard.LabelResourceName:      b.owner.GetName(),
+		starboard.LabelResourceNamespace: b.owner.GetNamespace(),
+		starboard.LabelContainerName:     b.container,
 	}
 
 	if b.hash != "" {
-		labels[kube.LabelPodSpecHash] = b.hash
+		labels[starboard.LabelPodSpecHash] = b.hash
 	}
 
 	reportName, err := b.reportName()
diff --git a/pkg/vulnerabilityreport/io.go b/pkg/vulnerabilityreport/io.go
index 564ece8..6f68665 100644
--- a/pkg/vulnerabilityreport/io.go
+++ b/pkg/vulnerabilityreport/io.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -87,9 +88,9 @@ func (r *readWriter) FindByOwner(ctx context.Context, owner kube.Object) ([]v1al
 	var list v1alpha1.VulnerabilityReportList
 
 	err := r.List(ctx, &list, client.MatchingLabels{
-		kube.LabelResourceKind:      string(owner.Kind),
-		kube.LabelResourceNamespace: owner.Namespace,
-		kube.LabelResourceName:      owner.Name,
+		starboard.LabelResourceKind:      string(owner.Kind),
+		starboard.LabelResourceNamespace: owner.Namespace,
+		starboard.LabelResourceName:      owner.Name,
 	}, client.InNamespace(owner.Namespace))
 	if err != nil {
 		return nil, err
diff --git a/pkg/vulnerabilityreport/scanner.go b/pkg/vulnerabilityreport/scanner.go
index 922d80a..f3f33df 100644
--- a/pkg/vulnerabilityreport/scanner.go
+++ b/pkg/vulnerabilityreport/scanner.go
@@ -133,12 +133,12 @@ func (s *Scanner) prepareScanJob(workload kube.Object, spec corev1.PodSpec, cred
 			Name:      s.GenerateID(),
 			Namespace: starboard.NamespaceName,
 			Labels: map[string]string{
-				kube.LabelResourceKind:      string(workload.Kind),
-				kube.LabelResourceName:      workload.Name,
-				kube.LabelResourceNamespace: workload.Namespace,
+				starboard.LabelResourceKind:      string(workload.Kind),
+				starboard.LabelResourceName:      workload.Name,
+				starboard.LabelResourceNamespace: workload.Namespace,
 			},
 			Annotations: map[string]string{
-				kube.AnnotationContainerImages: containerImagesAsJSON,
+				starboard.AnnotationContainerImages: containerImagesAsJSON,
 			},
 		},
 		Spec: batchv1.JobSpec{
@@ -148,9 +148,9 @@ func (s *Scanner) prepareScanJob(workload kube.Object, spec corev1.PodSpec, cred
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: map[string]string{
-						kube.LabelResourceKind:      string(workload.Kind),
-						kube.LabelResourceName:      workload.Name,
-						kube.LabelResourceNamespace: workload.Namespace,
+						starboard.LabelResourceKind:      string(workload.Kind),
+						starboard.LabelResourceName:      workload.Name,
+						starboard.LabelResourceNamespace: workload.Namespace,
 					},
 				},
 				Spec: templateSpec,


Test patch:
diff --git a/itest/helper/doc.go b/itest/helper/doc.go
new file mode 100644
index 0000000..a9c1dab
--- /dev/null
+++ b/itest/helper/doc.go
@@ -0,0 +1,2 @@
+// The helper package provides builders to instantiate Kubernetes objects used in integration tests.
+package helper
diff --git a/itest/helper/helper.go b/itest/helper/helper.go
index 3a99c6d..5d1fe32 100644
--- a/itest/helper/helper.go
+++ b/itest/helper/helper.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -161,10 +162,10 @@ func (b *VulnerabilityReportBuilder) Build() *v1alpha1.VulnerabilityReport {
 			Name:      b.name,
 			Namespace: b.namespace,
 			Labels: map[string]string{
-				kube.LabelContainerName:     "nginx", // TODO Make it configurable
-				kube.LabelResourceKind:      string(b.ownerKind),
-				kube.LabelResourceName:      b.ownerName,
-				kube.LabelResourceNamespace: b.namespace,
+				starboard.LabelContainerName:     "nginx", // TODO Make it configurable
+				starboard.LabelResourceKind:      string(b.ownerKind),
+				starboard.LabelResourceName:      b.ownerName,
+				starboard.LabelResourceNamespace: b.namespace,
 			},
 		},
 		Report: v1alpha1.VulnerabilityScanResult{
diff --git a/itest/matcher/matcher.go b/itest/matcher/matcher.go
index bf9207c..7ab74c3 100644
--- a/itest/matcher/matcher.go
+++ b/itest/matcher/matcher.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
-	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/onsi/gomega/types"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -61,10 +60,10 @@ func (m *vulnerabilityReportMatcher) Match(actual interface{}) (bool, error) {
 	matcher := MatchFields(IgnoreExtras, Fields{
 		"ObjectMeta": MatchFields(IgnoreExtras, Fields{
 			"Labels": MatchAllKeys(Keys{
-				kube.LabelContainerName:     Equal(m.containerName),
-				kube.LabelResourceKind:      Equal(gvk.Kind),
-				kube.LabelResourceName:      Equal(m.owner.GetName()),
-				kube.LabelResourceNamespace: Equal(m.owner.GetNamespace()),
+				starboard.LabelContainerName:     Equal(m.containerName),
+				starboard.LabelResourceKind:      Equal(gvk.Kind),
+				starboard.LabelResourceName:      Equal(m.owner.GetName()),
+				starboard.LabelResourceNamespace: Equal(m.owner.GetNamespace()),
 			}),
 			"OwnerReferences": ConsistOf(metav1.OwnerReference{
 				APIVersion:         gvk.GroupVersion().Identifier(),
@@ -129,9 +128,9 @@ func (m *configAuditReportMatcher) Match(actual interface{}) (bool, error) {
 	matcher := MatchFields(IgnoreExtras, Fields{
 		"ObjectMeta": MatchFields(IgnoreExtras, Fields{
 			"Labels": MatchAllKeys(Keys{
-				kube.LabelResourceKind:      Equal(gvk.Kind),
-				kube.LabelResourceName:      Equal(m.owner.GetName()),
-				kube.LabelResourceNamespace: Equal(m.owner.GetNamespace()),
+				starboard.LabelResourceKind:      Equal(gvk.Kind),
+				starboard.LabelResourceName:      Equal(m.owner.GetName()),
+				starboard.LabelResourceNamespace: Equal(m.owner.GetNamespace()),
 			}),
 			"OwnerReferences": ConsistOf(metav1.OwnerReference{
 				APIVersion:         gvk.GroupVersion().Identifier(),
diff --git a/itest/matcher/matcher_test.go b/itest/matcher/matcher_test.go
index 0f8985c..8ef8a63 100644
--- a/itest/matcher/matcher_test.go
+++ b/itest/matcher/matcher_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/aquasecurity/starboard/itest/matcher"
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
-	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -37,10 +37,10 @@ func TestVulnerabilityReportMatcher(t *testing.T) {
 				Name:      "pod-nginx-pod-nginx-container",
 				Namespace: "default",
 				Labels: map[string]string{
-					kube.LabelContainerName:     "nginx-container",
-					kube.LabelResourceKind:      "Pod",
-					kube.LabelResourceName:      "nginx-pod",
-					kube.LabelResourceNamespace: "default",
+					starboard.LabelContainerName:     "nginx-container",
+					starboard.LabelResourceKind:      "Pod",
+					starboard.LabelResourceName:      "nginx-pod",
+					starboard.LabelResourceNamespace: "default",
 				},
 				OwnerReferences: []metav1.OwnerReference{
 					{
@@ -90,9 +90,9 @@ func TestConfigAuditReportMatcher(t *testing.T) {
 				Name:      "replicaset-nginx-6d4cf56db6",
 				Namespace: "default",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      "ReplicaSet",
-					kube.LabelResourceName:      "nginx-6d4cf56db6",
-					kube.LabelResourceNamespace: "default",
+					starboard.LabelResourceKind:      "ReplicaSet",
+					starboard.LabelResourceName:      "nginx-6d4cf56db6",
+					starboard.LabelResourceNamespace: "default",
 				},
 				OwnerReferences: []metav1.OwnerReference{
 					{
diff --git a/itest/starboard-operator/starboard_operator_test.go b/itest/starboard-operator/starboard_operator_test.go
index 3a5da94..4b1b6e8 100644
--- a/itest/starboard-operator/starboard_operator_test.go
+++ b/itest/starboard-operator/starboard_operator_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/aquasecurity/starboard/itest/helper"
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/kube"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
@@ -230,9 +231,9 @@ func HasVulnerabilityReportOwnedBy(obj client.Object) func() (bool, error) {
 		}
 		var reportList v1alpha1.VulnerabilityReportList
 		err = kubeClient.List(context.Background(), &reportList, client.MatchingLabels{
-			kube.LabelResourceKind:      gvk.Kind,
-			kube.LabelResourceName:      obj.GetName(),
-			kube.LabelResourceNamespace: obj.GetNamespace(),
+			starboard.LabelResourceKind:      gvk.Kind,
+			starboard.LabelResourceName:      obj.GetName(),
+			starboard.LabelResourceNamespace: obj.GetNamespace(),
 		})
 		if err != nil {
 			return false, err
@@ -249,9 +250,9 @@ func HasConfigAuditReportOwnedBy(obj client.Object) func() (bool, error) {
 		}
 		var reportsList v1alpha1.ConfigAuditReportList
 		err = kubeClient.List(context.Background(), &reportsList, client.MatchingLabels{
-			kube.LabelResourceKind:      gvk.Kind,
-			kube.LabelResourceName:      obj.GetName(),
-			kube.LabelResourceNamespace: obj.GetNamespace(),
+			starboard.LabelResourceKind:      gvk.Kind,
+			starboard.LabelResourceName:      obj.GetName(),
+			starboard.LabelResourceNamespace: obj.GetNamespace(),
 		})
 		if err != nil {
 			return false, err
diff --git a/itest/starboard/starboard_cli_test.go b/itest/starboard/starboard_cli_test.go
index 888d49f..bc71fd5 100644
--- a/itest/starboard/starboard_cli_test.go
+++ b/itest/starboard/starboard_cli_test.go
@@ -161,7 +161,7 @@ var _ = Describe("Starboard CLI", func() {
 
 		groupByContainerName := func(element interface{}) string {
 			return element.(v1alpha1.VulnerabilityReport).
-				Labels[kube.LabelContainerName]
+				Labels[starboard.LabelContainerName]
 		}
 
 		Context("when unmanaged Pod is specified as workload", func() {
@@ -188,9 +188,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindPod),
-					kube.LabelResourceName:      pod.Name,
-					kube.LabelResourceNamespace: pod.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindPod),
+					starboard.LabelResourceName:      pod.Name,
+					starboard.LabelResourceNamespace: pod.Namespace,
 				})
 
 				Expect(err).ToNot(HaveOccurred())
@@ -231,9 +231,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindPod),
-					kube.LabelResourceName:      pod.Name,
-					kube.LabelResourceNamespace: pod.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindPod),
+					starboard.LabelResourceName:      pod.Name,
+					starboard.LabelResourceNamespace: pod.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByContainerName, Elements{
@@ -290,9 +290,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindPod),
-					kube.LabelResourceName:      pod.Name,
-					kube.LabelResourceNamespace: pod.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindPod),
+					starboard.LabelResourceName:      pod.Name,
+					starboard.LabelResourceNamespace: pod.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByContainerName, Elements{
@@ -358,9 +358,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindReplicaSet),
-					kube.LabelResourceName:      rs.Name,
-					kube.LabelResourceNamespace: rs.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindReplicaSet),
+					starboard.LabelResourceName:      rs.Name,
+					starboard.LabelResourceNamespace: rs.Namespace,
 				})
 
 				Expect(err).ToNot(HaveOccurred())
@@ -424,9 +424,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindReplicationController),
-					kube.LabelResourceName:      rc.Name,
-					kube.LabelResourceNamespace: rc.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindReplicationController),
+					starboard.LabelResourceName:      rc.Name,
+					starboard.LabelResourceNamespace: rc.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByContainerName, Elements{
@@ -465,9 +465,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindDeployment),
-					kube.LabelResourceName:      deploy.Name,
-					kube.LabelResourceNamespace: deploy.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindDeployment),
+					starboard.LabelResourceName:      deploy.Name,
+					starboard.LabelResourceNamespace: deploy.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByContainerName, Elements{
@@ -531,9 +531,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindStatefulSet),
-					kube.LabelResourceName:      sts.Name,
-					kube.LabelResourceNamespace: sts.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindStatefulSet),
+					starboard.LabelResourceName:      sts.Name,
+					starboard.LabelResourceNamespace: sts.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByContainerName, Elements{
@@ -596,9 +596,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.VulnerabilityReportList
 				err = kubeClient.List(context.TODO(), &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindDaemonSet),
-					kube.LabelResourceName:      ds.Name,
-					kube.LabelResourceNamespace: ds.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindDaemonSet),
+					starboard.LabelResourceName:      ds.Name,
+					starboard.LabelResourceNamespace: ds.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByContainerName, Elements{
@@ -834,7 +834,7 @@ var _ = Describe("Starboard CLI", func() {
 
 		groupByWorkloadName := func(element interface{}) string {
 			return element.(v1alpha1.ConfigAuditReport).
-				Labels[kube.LabelResourceName]
+				Labels[starboard.LabelResourceName]
 		}
 
 		Context("when unmanaged Pod is specified as workload", func() {
@@ -863,9 +863,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.ConfigAuditReportList
 				err = kubeClient.List(ctx, &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindPod),
-					kube.LabelResourceName:      pod.Name,
-					kube.LabelResourceNamespace: pod.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindPod),
+					starboard.LabelResourceName:      pod.Name,
+					starboard.LabelResourceNamespace: pod.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 
@@ -908,9 +908,9 @@ var _ = Describe("Starboard CLI", func() {
 
 				var reportList v1alpha1.ConfigAuditReportList
 				err = kubeClient.List(ctx, &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindPod),
-					kube.LabelResourceName:      pod.Name,
-					kube.LabelResourceNamespace: pod.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindPod),
+					starboard.LabelResourceName:      pod.Name,
+					starboard.LabelResourceNamespace: pod.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 
@@ -978,9 +978,9 @@ var _ = Describe("Starboard CLI", func() {
 				var reportList v1alpha1.ConfigAuditReportList
 
 				err = kubeClient.List(ctx, &reportList, client.MatchingLabels{
-					kube.LabelResourceKind:      string(kube.KindCronJob),
-					kube.LabelResourceName:      cronJob.Name,
-					kube.LabelResourceNamespace: cronJob.Namespace,
+					starboard.LabelResourceKind:      string(kube.KindCronJob),
+					starboard.LabelResourceName:      cronJob.Name,
+					starboard.LabelResourceNamespace: cronJob.Namespace,
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(reportList.Items).To(MatchAllElements(groupByWorkloadName, Elements{
@@ -1019,8 +1019,8 @@ var _ = Describe("Starboard CLI", func() {
 				Expect(report).To(MatchFields(IgnoreExtras, Fields{
 					"ObjectMeta": MatchFields(IgnoreExtras, Fields{
 						"Labels": MatchAllKeys(Keys{
-							kube.LabelResourceKind: Equal("Node"),
-							kube.LabelResourceName: Equal(node.Name),
+							starboard.LabelResourceKind: Equal("Node"),
+							starboard.LabelResourceName: Equal(node.Name),
 						}),
 						"OwnerReferences": ConsistOf(metav1.OwnerReference{
 							APIVersion:         "v1",
@@ -1074,8 +1074,8 @@ var _ = Describe("Starboard CLI", func() {
 			err = kubeClient.Get(context.TODO(), types.NamespacedName{Name: "cluster"}, &report)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(report.Labels).To(MatchAllKeys(Keys{
-				kube.LabelResourceKind: Equal("Cluster"),
-				kube.LabelResourceName: Equal("cluster"),
+				starboard.LabelResourceKind: Equal("Cluster"),
+				starboard.LabelResourceName: Equal("cluster"),
 			}))
 		})
 	})
diff --git a/pkg/configauditreport/io_test.go b/pkg/configauditreport/io_test.go
index c58c189..f228069 100644
--- a/pkg/configauditreport/io_test.go
+++ b/pkg/configauditreport/io_test.go
@@ -144,9 +144,9 @@ func TestReadWriter(t *testing.T) {
 				Namespace: "my-namespace",
 				Name:      "deployment-my-deploy-my",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      string(kube.KindDeployment),
-					kube.LabelResourceName:      "my-deploy",
-					kube.LabelResourceNamespace: "my-namespace",
+					starboard.LabelResourceKind:      string(kube.KindDeployment),
+					starboard.LabelResourceName:      "my-deploy",
+					starboard.LabelResourceNamespace: "my-namespace",
 				},
 			},
 			Report: v1alpha1.ConfigAuditResult{},
@@ -155,9 +155,9 @@ func TestReadWriter(t *testing.T) {
 				Namespace: "my-namespace",
 				Name:      "my-sts",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      string(kube.KindStatefulSet),
-					kube.LabelResourceName:      "my-sts",
-					kube.LabelResourceNamespace: "my-namespace",
+					starboard.LabelResourceKind:      string(kube.KindStatefulSet),
+					starboard.LabelResourceName:      "my-sts",
+					starboard.LabelResourceNamespace: "my-namespace",
 				},
 			},
 			Report: v1alpha1.ConfigAuditResult{},
@@ -175,9 +175,9 @@ func TestReadWriter(t *testing.T) {
 				Namespace: "my-namespace",
 				Name:      "deployment-my-deploy-my",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      string(kube.KindDeployment),
-					kube.LabelResourceName:      "my-deploy",
-					kube.LabelResourceNamespace: "my-namespace",
+					starboard.LabelResourceKind:      string(kube.KindDeployment),
+					starboard.LabelResourceName:      "my-deploy",
+					starboard.LabelResourceNamespace: "my-namespace",
 				},
 			},
 			Report: v1alpha1.ConfigAuditResult{},
diff --git a/pkg/kube/object_test.go b/pkg/kube/object_test.go
index 0d8ab61..9c471b9 100644
--- a/pkg/kube/object_test.go
+++ b/pkg/kube/object_test.go
@@ -69,9 +69,9 @@ func TestObjectFromLabelsSet(t *testing.T) {
 		{
 			name: "Should return object for namespaced object",
 			labelsSet: labels.Set{
-				kube.LabelResourceKind:      "Deployment",
-				kube.LabelResourceName:      "my-deployment",
-				kube.LabelResourceNamespace: "my-namespace",
+				starboard.LabelResourceKind:      "Deployment",
+				starboard.LabelResourceName:      "my-deployment",
+				starboard.LabelResourceNamespace: "my-namespace",
 			},
 			expectedObject: kube.Object{
 				Kind:      kube.KindDeployment,
@@ -82,8 +82,8 @@ func TestObjectFromLabelsSet(t *testing.T) {
 		{
 			name: "Should return object for cluster-scoped object",
 			labelsSet: labels.Set{
-				kube.LabelResourceKind: "Node",
-				kube.LabelResourceName: "my-node",
+				starboard.LabelResourceKind: "Node",
+				starboard.LabelResourceName: "my-node",
 			},
 			expectedObject: kube.Object{
 				Kind:      kube.KindNode,
@@ -94,15 +94,15 @@ func TestObjectFromLabelsSet(t *testing.T) {
 		{
 			name: "Should return error when object kind is not specified as label",
 			labelsSet: labels.Set{
-				kube.LabelResourceName:      "my-deployment",
-				kube.LabelResourceNamespace: "my-namespace",
+				starboard.LabelResourceName:      "my-deployment",
+				starboard.LabelResourceNamespace: "my-namespace",
 			},
 			expectedError: errors.New("required label does not exist: starboard.resource.kind"),
 		},
 		{
 			name: "Should return error when object name is not specified as label",
 			labelsSet: labels.Set{
-				kube.LabelResourceKind: "Deployment",
+				starboard.LabelResourceKind: "Deployment",
 			},
 			expectedError: errors.New("required label does not exist: starboard.resource.name"),
 		},
diff --git a/pkg/kubebench/io_test.go b/pkg/kubebench/io_test.go
index 7659ce2..16cbf05 100644
--- a/pkg/kubebench/io_test.go
+++ b/pkg/kubebench/io_test.go
@@ -25,8 +25,8 @@ func TestReadWriter(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "control-plane",
 				Labels: map[string]string{
-					kube.LabelResourceKind: string(kube.KindNode),
-					kube.LabelResourceName: "control-plane",
+					starboard.LabelResourceKind: string(kube.KindNode),
+					starboard.LabelResourceName: "control-plane",
 				},
 			},
 			Report: v1alpha1.CISKubeBenchOutput{
@@ -58,8 +58,8 @@ func TestReadWriter(t *testing.T) {
 				Name:            "control-plane",
 				ResourceVersion: "1",
 				Labels: map[string]string{
-					kube.LabelResourceKind: string(kube.KindNode),
-					kube.LabelResourceName: "control-plane",
+					starboard.LabelResourceKind: string(kube.KindNode),
+					starboard.LabelResourceName: "control-plane",
 				},
 			},
 			Report: v1alpha1.CISKubeBenchOutput{
@@ -85,8 +85,8 @@ func TestReadWriter(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "control-plane",
 					Labels: map[string]string{
-						kube.LabelResourceKind: string(kube.KindNode),
-						kube.LabelResourceName: "control-plane",
+						starboard.LabelResourceKind: string(kube.KindNode),
+						starboard.LabelResourceName: "control-plane",
 					},
 				},
 				Report: v1alpha1.CISKubeBenchOutput{
@@ -109,8 +109,8 @@ func TestReadWriter(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "control-plane",
 				Labels: map[string]string{
-					kube.LabelResourceKind: string(kube.KindNode),
-					kube.LabelResourceName: "control-plane",
+					starboard.LabelResourceKind: string(kube.KindNode),
+					starboard.LabelResourceName: "control-plane",
 				},
 			},
 			Report: v1alpha1.CISKubeBenchOutput{
@@ -141,8 +141,8 @@ func TestReadWriter(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "control-plane",
 				Labels: map[string]string{
-					kube.LabelResourceKind: string(kube.KindNode),
-					kube.LabelResourceName: "control-plane",
+					starboard.LabelResourceKind: string(kube.KindNode),
+					starboard.LabelResourceName: "control-plane",
 				},
 				ResourceVersion: "1",
 			},
@@ -169,8 +169,8 @@ func TestReadWriter(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "control-plane",
 					Labels: map[string]string{
-						kube.LabelResourceKind: string(kube.KindNode),
-						kube.LabelResourceName: "control-plane",
+						starboard.LabelResourceKind: string(kube.KindNode),
+						starboard.LabelResourceName: "control-plane",
 					},
 				},
 				Report: v1alpha1.CISKubeBenchOutput{
@@ -190,8 +190,8 @@ func TestReadWriter(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "worker",
 					Labels: map[string]string{
-						kube.LabelResourceKind: string(kube.KindNode),
-						kube.LabelResourceName: "worker",
+						starboard.LabelResourceKind: string(kube.KindNode),
+						starboard.LabelResourceName: "worker",
 					},
 				},
 				Report: v1alpha1.CISKubeBenchOutput{
@@ -222,8 +222,8 @@ func TestReadWriter(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "worker",
 				Labels: map[string]string{
-					kube.LabelResourceKind: string(kube.KindNode),
-					kube.LabelResourceName: "worker",
+					starboard.LabelResourceKind: string(kube.KindNode),
+					starboard.LabelResourceName: "worker",
 				},
 			},
 			Report: v1alpha1.CISKubeBenchOutput{
diff --git a/pkg/kubehunter/writer_test.go b/pkg/kubehunter/writer_test.go
index f32827d..9b08bc0 100644
--- a/pkg/kubehunter/writer_test.go
+++ b/pkg/kubehunter/writer_test.go
@@ -6,8 +6,8 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/generated/clientset/versioned/fake"
-	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/kubehunter"
+	"github.com/aquasecurity/starboard/pkg/starboard"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -38,8 +38,8 @@ func TestWriter_Write(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "my-cluster",
 					Labels: map[string]string{
-						kube.LabelResourceKind: "Cluster",
-						kube.LabelResourceName: "my-cluster",
+						starboard.LabelResourceKind: "Cluster",
+						starboard.LabelResourceName: "my-cluster",
 					},
 				},
 				Report: v1alpha1.KubeHunterOutput{
@@ -56,8 +56,8 @@ func TestWriter_Write(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "my-cluster",
 				Labels: map[string]string{
-					kube.LabelResourceKind: "Cluster",
-					kube.LabelResourceName: "my-cluster",
+					starboard.LabelResourceKind: "Cluster",
+					starboard.LabelResourceName: "my-cluster",
 				},
 			},
 			Report: v1alpha1.KubeHunterOutput{
@@ -87,8 +87,8 @@ func TestWriter_Write(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "my-cluster",
 					Labels: map[string]string{
-						kube.LabelResourceKind: "Cluster",
-						kube.LabelResourceName: "my-cluster",
+						starboard.LabelResourceKind: "Cluster",
+						starboard.LabelResourceName: "my-cluster",
 					},
 				},
 				Report: v1alpha1.KubeHunterOutput{
diff --git a/pkg/operator/controller/limit_checker_test.go b/pkg/operator/controller/limit_checker_test.go
index 4afa0c8..2ad319a 100644
--- a/pkg/operator/controller/limit_checker_test.go
+++ b/pkg/operator/controller/limit_checker_test.go
@@ -1,14 +1,14 @@
 package controller_test
 
 import (
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
 	"context"
 
-	"github.com/aquasecurity/starboard/pkg/kube"
 	"github.com/aquasecurity/starboard/pkg/operator/controller"
 	"github.com/aquasecurity/starboard/pkg/operator/etc"
 	"github.com/aquasecurity/starboard/pkg/starboard"
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
 	batchv1 "k8s.io/api/batch/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -34,21 +34,21 @@ var _ = Describe("LimitChecker", func() {
 					Name:      "scan-vulnerabilityreport-hash1",
 					Namespace: "starboard-operator",
 					Labels: map[string]string{
-						kube.LabelK8SAppManagedBy: kube.AppStarboardOperator,
+						starboard.LabelK8SAppManagedBy: starboard.AppStarboardOperator,
 					},
 				}},
 				&batchv1.Job{ObjectMeta: metav1.ObjectMeta{
 					Name:      "scan-vulnerabilityreport-hash2",
 					Namespace: "starboard-operator",
 					Labels: map[string]string{
-						kube.LabelK8SAppManagedBy: kube.AppStarboardOperator,
+						starboard.LabelK8SAppManagedBy: starboard.AppStarboardOperator,
 					},
 				}},
 				&batchv1.Job{ObjectMeta: metav1.ObjectMeta{
 					Name:      "scan-configauditreport-hash2",
 					Namespace: "starboard-operator",
 					Labels: map[string]string{
-						kube.LabelK8SAppManagedBy: kube.AppStarboardOperator,
+						starboard.LabelK8SAppManagedBy: starboard.AppStarboardOperator,
 					},
 				}},
 			).Build()
@@ -74,7 +74,7 @@ var _ = Describe("LimitChecker", func() {
 					Name:      "scan-vulnerabilityreport-hash1",
 					Namespace: "starboard-operator",
 					Labels: map[string]string{
-						kube.LabelK8SAppManagedBy: kube.AppStarboardOperator,
+						starboard.LabelK8SAppManagedBy: starboard.AppStarboardOperator,
 					},
 				}},
 			).Build()
diff --git a/pkg/plugin/conftest/plugin.go b/pkg/plugin/conftest/plugin.go
index af95c9a..9872002 100644
--- a/pkg/plugin/conftest/plugin.go
+++ b/pkg/plugin/conftest/plugin.go
@@ -114,7 +114,7 @@ func (p *plugin) GetScanJobSpec(ctx starboard.PluginContext, obj client.Object)
 				VolumeSource: corev1.VolumeSource{
 					ConfigMap: &corev1.ConfigMapVolumeSource{
 						LocalObjectReference: corev1.LocalObjectReference{
-							Name: "conftestconfig",
+							Name: "starboard-conftest-config",
 						},
 						Items: volumeItems,
 					},
diff --git a/pkg/vulnerabilityreport/builder_test.go b/pkg/vulnerabilityreport/builder_test.go
index c5f4922..3d735f1 100644
--- a/pkg/vulnerabilityreport/builder_test.go
+++ b/pkg/vulnerabilityreport/builder_test.go
@@ -5,8 +5,7 @@ import (
 
 	"github.com/aquasecurity/starboard/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/aquasecurity/starboard/pkg/vulnerabilityreport"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes/scheme"
@@ -14,6 +13,7 @@ import (
 )
 
 func TestBuilder(t *testing.T) {
+	g := gomega.NewGomegaWithT(t)
 	report, err := vulnerabilityreport.NewBuilder(scheme.Scheme).
 		Owner(&appsv1.ReplicaSet{
 			ObjectMeta: metav1.ObjectMeta{
@@ -25,8 +25,8 @@ func TestBuilder(t *testing.T) {
 		PodSpecHash("xyz").
 		Result(v1alpha1.VulnerabilityScanResult{}).Get()
 
-	require.NoError(t, err)
-	assert.Equal(t, v1alpha1.VulnerabilityReport{
+	g.Expect(err).ToNot(gomega.HaveOccurred())
+	g.Expect(report).To(gomega.Equal(v1alpha1.VulnerabilityReport{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      "replicaset-some-owner-my-container",
 			Namespace: "qa",
@@ -48,5 +48,5 @@ func TestBuilder(t *testing.T) {
 			},
 		},
 		Report: v1alpha1.VulnerabilityScanResult{},
-	}, report)
+	}))
 }
diff --git a/pkg/vulnerabilityreport/io_test.go b/pkg/vulnerabilityreport/io_test.go
index 8018352..596a9a6 100644
--- a/pkg/vulnerabilityreport/io_test.go
+++ b/pkg/vulnerabilityreport/io_test.go
@@ -64,11 +64,11 @@ func TestNewReadWriter(t *testing.T) {
 					Namespace: "qa",
 					Name:      "deployment-app1-container1",
 					Labels: map[string]string{
-						kube.LabelResourceKind:      "Deployment",
-						kube.LabelResourceName:      "app1",
-						kube.LabelResourceNamespace: "qa",
-						kube.LabelContainerName:     "container1",
-						kube.LabelPodSpecHash:       "h1",
+						starboard.LabelResourceKind:      "Deployment",
+						starboard.LabelResourceName:      "app1",
+						starboard.LabelResourceNamespace: "qa",
+						starboard.LabelContainerName:     "container1",
+						starboard.LabelPodSpecHash:       "h1",
 					},
 					ResourceVersion: "1",
 				},
@@ -78,11 +78,11 @@ func TestNewReadWriter(t *testing.T) {
 					Namespace: "qa",
 					Name:      "deployment-app1-container2",
 					Labels: map[string]string{
-						kube.LabelResourceKind:      "Deployment",
-						kube.LabelResourceName:      "app1",
-						kube.LabelResourceNamespace: "qa",
-						kube.LabelContainerName:     "container2",
-						kube.LabelPodSpecHash:       "h1",
+						starboard.LabelResourceKind:      "Deployment",
+						starboard.LabelResourceName:      "app1",
+						starboard.LabelResourceNamespace: "qa",
+						starboard.LabelContainerName:     "container2",
+						starboard.LabelPodSpecHash:       "h1",
 					},
 					ResourceVersion: "1",
 				},
@@ -205,10 +205,10 @@ func TestNewReadWriter(t *testing.T) {
 				Namespace: "my-namespace",
 				Name:      "deployment-my-deploy-my-container-01",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      string(kube.KindDeployment),
-					kube.LabelResourceName:      "my-deploy",
-					kube.LabelResourceNamespace: "my-namespace",
-					kube.LabelContainerName:     "my-container-01",
+					starboard.LabelResourceKind:      string(kube.KindDeployment),
+					starboard.LabelResourceName:      "my-deploy",
+					starboard.LabelResourceNamespace: "my-namespace",
+					starboard.LabelContainerName:     "my-container-01",
 				},
 			},
 			Report: v1alpha1.VulnerabilityScanResult{},
@@ -217,10 +217,10 @@ func TestNewReadWriter(t *testing.T) {
 				Namespace: "my-namespace",
 				Name:      "deployment-my-deploy-my-container-02",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      string(kube.KindDeployment),
-					kube.LabelResourceName:      "my-deploy",
-					kube.LabelResourceNamespace: "my-namespace",
-					kube.LabelContainerName:     "my-container-02",
+					starboard.LabelResourceKind:      string(kube.KindDeployment),
+					starboard.LabelResourceName:      "my-deploy",
+					starboard.LabelResourceNamespace: "my-namespace",
+					starboard.LabelContainerName:     "my-container-02",
 				},
 			},
 			Report: v1alpha1.VulnerabilityScanResult{},
@@ -229,10 +229,10 @@ func TestNewReadWriter(t *testing.T) {
 				Namespace: "my-namespace",
 				Name:      "my-sts",
 				Labels: map[string]string{
-					kube.LabelResourceKind:      string(kube.KindStatefulSet),
-					kube.LabelResourceName:      "my-sts",
-					kube.LabelResourceNamespace: "my-namespace",
-					kube.LabelContainerName:     "my-sts-container",
+					starboard.LabelResourceKind:      string(kube.KindStatefulSet),
+					starboard.LabelResourceName:      "my-sts",
+					starboard.LabelResourceNamespace: "my-namespace",
+					starboard.LabelContainerName:     "my-sts-container",
 				},
 			},
 			Report: v1alpha1.VulnerabilityScanResult{},