mondoo-operator/tests/e2e/gke/manifests/mondoo-audit-config-asset-routing-autopilot.yaml.tpl at 1d0c71ba57bf69a5bb52a9a517a2366c21f64a0f · mondoohq/mondoo-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# Copyright Mondoo, Inc. 2026
# SPDX-License-Identifier: BUSL-1.1

# MondooAuditConfig for scanning the LOCAL cluster (Autopilot — no nodes).
# No spaceId — server-side asset routing rules determine destination spaces.
apiVersion: k8s.mondoo.com/v1alpha2
kind: MondooAuditConfig
metadata:
  name: mondoo-scanner
  namespace: ${NAMESPACE}
spec:
  mondooCredsSecretRef:
    name: mondoo-client
  filtering:
    namespaces:
      exclude:
        - kube-system
        - gke-managed-system
        - gke-managed-cim
  kubernetesResources:
    enable: true
    schedule: "*/5 * * * *"
  containers:
    enable: true
    schedule: "*/5 * * * *"
  nodes:
    enable: false
---
# MondooAuditConfig for scanning the REMOTE (target) cluster.
# No spaceId — server-side asset routing rules determine destination spaces.
# enable: false prevents local cluster scanning; externalClusters reconciles independently.
apiVersion: k8s.mondoo.com/v1alpha2
kind: MondooAuditConfig
metadata:
  name: mondoo-target
  namespace: ${NAMESPACE}
spec:
  mondooCredsSecretRef:
    name: mondoo-client
  filtering:
    namespaces:
      exclude:
        - kube-system
        - gke-managed-system
        - gke-managed-cim
  kubernetesResources:
    enable: false
    schedule: "*/5 * * * *"
    externalClusters:
      - name: target-cluster
        kubeconfigSecretRef:
          name: target-kubeconfig
  containers:
    enable: false
  nodes:
    enable: false