fixed host sensor issue

update pkg
support printing sensor and cloud resources
2026-03-17 17:10:34 +00:00 · 2021-12-21 13:09:31 +02:00 · 2021-12-21 11:04:18 +02:00 · 2021-12-20 18:22:08 +02:00 · 2021-12-20 13:32:14 +02:00 · 2021-12-20 11:14:31 +02:00
107 changed files with 10045 additions and 1275 deletions
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -46,6 +46,12 @@ jobs:
          CGO_ENABLED: 0
        run: python3 --version && python3 build.py
      
+      - name: Smoke Testing
+        env:
+          RELEASE: v1.0.${{ github.run_number }} 
+          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
+        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape
+
      - name: Upload Release binaries
        id: upload-release-asset
        uses: actions/upload-release-asset@v1
@@ -71,8 +77,8 @@ jobs:
        run: echo quay.io/armosec/kubescape:v1.0.${{ github.run_number }} > build_tag.txt

      - name: Build the Docker image
-        run: docker build . --file build/Dockerfile --tag $(cat build_tag.txt)
-      
+        run: docker build . --file build/Dockerfile --tag $(cat build_tag.txt) --build-arg run_number=${{ github.run_number }}
+
      - name: Re-Tag Image to latest
        run: docker tag $(cat build_tag.txt) quay.io/armosec/kubescape:latest

--- a/.github/workflows/build_dev.yaml
+++ b/.github/workflows/build_dev.yaml
@@ -30,6 +30,12 @@ jobs:
          CGO_ENABLED: 0
        run: python3 --version && python3 build.py
      
+      - name: Smoke Testing
+        env:
+          RELEASE: v1.0.${{ github.run_number }}
+          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
+        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape
+
      - name: Upload build artifacts 
        uses: actions/upload-artifact@v2
        with:
@@ -50,7 +56,7 @@ jobs:
        run: echo quay.io/armosec/kubescape:dev-v1.0.${{ github.run_number }} > build_tag.txt

      - name: Build the Docker image
-        run: docker build . --file build/Dockerfile --tag $(cat build_tag.txt)
+        run: docker build . --file build/Dockerfile --tag $(cat build_tag.txt) --build-arg run_number=${{ github.run_number }}
      
      - name: Login to Quay.io
        env: # Or as an environment variable
--- a/.github/workflows/master_pr_checks.yaml
+++ b/.github/workflows/master_pr_checks.yaml
@@ -31,8 +31,9 @@ jobs:
          CGO_ENABLED: 0
        run: python3 --version && python3 build.py

-      - name: Upload build artifacts 
-        uses: actions/upload-artifact@v2
-        with:
-          name: kubescape-${{ matrix.os }}
-          path: build/${{ matrix.os }}/kubescape 
+      - name: Smoke Testing
+        env:
+          RELEASE: v1.0.${{ github.run_number }} 
+          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
+        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape
+        
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,5 @@
 *kubescape*
 *debug*
 *vender*
+*.pyc*
 .idea
--- a/README.md
+++ b/README.md
@@ -24,13 +24,22 @@ curl -s https://raw.githubusercontent.com/armosec/kubescape/master/install.sh |

 ## Run:
 ```
-kubescape scan framework nsa
+kubescape scan --submit
 ```

 <img src="docs/summary.png">

+</br>
+
+> Kubescape is an open source project, we welcome your feedback and ideas for improvement. We’re also aiming to collaborate with the Kubernetes community to help make the tests themselves more robust and complete as Kubernetes develops.
+
+</br>
+
 ### Click [👍](https://github.com/armosec/kubescape/stargazers) if you want us to continue to develop and improve Kubescape 😀

+</br>
+
+
 # Being part of the team

 We invite you to our team! We are excited about this project and want to return the love we get.
@@ -42,8 +51,16 @@ Want to contribute? Want to discuss something? Have an issue?

 [<img src="docs/discord-banner.png" width="100" alt="logo" align="center">](https://armosec.github.io/kubescape/)

+
 # Options and examples

+## Tutorials
+
+* [Overview](https://youtu.be/wdBkt_0Qhbg)
+* [Scanning Kubernetes YAML files](https://youtu.be/Ox6DaR7_4ZI)
+* [Scan Kubescape on an air-gapped environment (offline support)](https://youtu.be/IGXL9s37smM)
+* [Managing exceptions in the Kubescape SaaS version](https://youtu.be/OzpvxGmCR80)
+
 ## Install on Windows

 **Requires powershell v5.0+**
@@ -69,74 +86,105 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser

 ## Flags

-| flag |  default | description | options |
-| --- | --- | --- | --- |
-| `-e`/`--exclude-namespaces` | Scan all namespaces | Namespaces to exclude from scanning. Recommended to exclude `kube-system` and `kube-public` namespaces |
-| `-s`/`--silent` | Display progress messages | Silent progress messages |
-| `-t`/`--fail-threshold` | `0` (do not fail) | fail command (return exit code 1) if result bellow threshold| `0` -> `100` |
-| `-f`/`--format` | `pretty-printer` | Output format | `pretty-printer`/`json`/`junit` |
-| `-o`/`--output` | print to stdout | Save scan result in file |
-| `--use-from` | | Load local framework object from specified path. If not used will download latest |
-| `--use-default` | `false` | Load local framework object from default path. If not used will download latest | `true`/`false` |
-| `--exceptions` | | Path to an [exceptions obj](examples/exceptions.json). If not set will download exceptions from Armo management portal |
-| `--submit` | `false` | If set, Kubescape will send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not sent | `true`/`false`|
-| `--keep-local` | `false` | Kubescape will not send scan results to Armo management portal. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results | `true`/`false`|
-| `--account` | | Armo portal account ID. Default will load account ID from configMap or config file | |
+| flag                        | default                   | description                                                                                                                                                                                                                                                                                                          | options                          |
+|-----------------------------|---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|
+| `-e`/`--exclude-namespaces` | Scan all namespaces       | Namespaces to exclude from scanning. Recommended to exclude `kube-system` and `kube-public` namespaces                                                                                                                                                                                                               |                                              |
+| `--include-namespaces`      | Scan all namespaces       | Scan specific namespaces                                                                                                                            |                                              |
+| `-s`/`--silent`             | Display progress messages | Silent progress messages                                                                                                                                                                                                                                                                                             |                                              |
+| `-t`/`--fail-threshold`     | `0` (do not fail)         | fail command (return exit code 1) if result is below threshold                                                                                                                                                                                                                                                       | `0` -> `100`                                 |
+| `-f`/`--format`             | `pretty-printer`          | Output format                                                                                                                                                                                                                                                                                                        | `pretty-printer`/`json`/`junit`/`prometheus` |
+| `-o`/`--output`             | print to stdout           | Save scan result in file                                                                                                                                                                                                                                                                                             |                                              |
+| `--use-from`                |                           | Load local framework object from specified path. If not used will download latest                                                                                                                                                                                                                                    |                                              |
+| `--use-default`             | `false`                   | Load local framework object from default path. If not used will download latest                                                                                                                                                                                                                                      | `true`/`false`                               |
+| `--exceptions`              |                           | Path to an [exceptions obj](examples/exceptions.json). If not set will download exceptions from Armo management portal                                                                                                                                                                                               |                                              |
+| `--submit`                  | `false`                   | If set, Kubescape will send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not sent | `true`/`false`                               |
+| `--keep-local`              | `false`                   | Kubescape will not send scan results to Armo management portal. Use this flag if you ran with the `--submit` flag in the past and you do not want to submit your current scan results                                                                                                                                | `true`/`false`                               |
+| `--account`                 |                           | Armo portal account ID. Default will load account ID from configMap or config file                                                                                                                                                                                                                                   |                                              |
+| `--verbose`                 | `false`                   | Display all of the input resources and not only failed resources                                                                                                                                                                                                                                                     | `true`/`false`                               |
+

 ## Usage & Examples

 ### Examples

-* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to [ARMO portal](https://portal.armo.cloud/)
+#### Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to the [Kubescape SaaS version](https://portal.armo.cloud/)
 ```
 kubescape scan framework nsa --submit
 ```


-* Scan a running Kubernetes cluster with [`MITRE ATT&CK®`](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) framework and submit results to [ARMO portal](https://portal.armo.cloud/)
+#### Scan a running Kubernetes cluster with [`MITRE ATT&CK®`](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) framework and submit results to the [Kubescape SaaS version](https://portal.armo.cloud/)
 ```
 kubescape scan framework mitre --submit
 ```

-* Scan local `yaml`/`json` files before deploying. [Take a look at the demonstration](https://youtu.be/Ox6DaR7_4ZI)
+
+#### Scan a running Kubernetes cluster with a specific control using the control name or control ID. [List of controls](https://hub.armo.cloud/docs/controls) 
+```
+kubescape scan control "Privileged container"
+```
+
+#### Scan specific namespaces
+```
+kubescape scan framework nsa --include-namespaces development,staging,production
+```
+
+#### Scan cluster and exclude some namespaces
+```
+kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
+```
+
+#### Scan local `yaml`/`json` files before deploying. [Take a look at the demonstration](https://youtu.be/Ox6DaR7_4ZI)
 ```
 kubescape scan framework nsa *.yaml
 ```

-
-* Scan `yaml`/`json` files from url
+#### Scan kubernetes manifest files from a public github repository 
 ```
-kubescape scan framework nsa https://raw.githubusercontent.com/GoogleCloudPlatform/microservices-demo/master/release/kubernetes-manifests.yaml
+kubescape scan framework nsa https://github.com/armosec/kubescape
 ```

-* Output in `json` format
+#### Display all scanned resources (including the resources who passed) 
 ```
-kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --format json --output results.json
+kubescape scan framework nsa --verbose
 ```

-* Output in `junit xml` format
+#### Output in `json` format
 ```
-kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --format junit --output results.xml
+kubescape scan framework nsa --format json --output results.json
 ```

-* Scan with exceptions, objects with exceptions will be presented as `exclude` and not `fail`
+#### Output in `junit xml` format
 ```
-kubescape scan framework nsa --exceptions examples/exceptions.json
+kubescape scan framework nsa --format junit --output results.xml
 ```

-### Helm Support
+#### Output in `prometheus` metrics format - Contributed by [@Joibel](https://github.com/Joibel)
+```
+kubescape scan framework nsa --format prometheus
+```

-* Render the helm chart using [`helm template`](https://helm.sh/docs/helm/helm_template/) and pass to stdout
+#### Scan with exceptions, objects with exceptions will be presented as `exclude` and not `fail`
+[Full documentation](examples/exceptions/README.md)
+```
+kubescape scan framework nsa --exceptions examples/exceptions/exclude-kube-namespaces.json
+```
+
+#### Scan Helm charts - Render the helm chart using [`helm template`](https://helm.sh/docs/helm/helm_template/) and pass to stdout
 ```
 helm template [NAME] [CHART] [flags] --dry-run | kubescape scan framework nsa -
 ```

-for example:
+e.g.
 ```
 helm template bitnami/mysql --generate-name --dry-run | kubescape scan framework nsa -
 ```
+
+
 ### Offline Support

+[Video tutorial](https://youtu.be/IGXL9s37smM)
+
 It is possible to run Kubescape offline!

 First download the framework and then scan with `--use-from` flag
@@ -151,13 +199,40 @@ kubescape download framework nsa --output nsa.json
 kubescape scan framework nsa --use-from nsa.json
 ```

-Kubescape is an open source project, we welcome your feedback and ideas for improvement. We’re also aiming to collaborate with the Kubernetes community to help make the tests themselves more robust and complete as Kubernetes develops.

+## Scan Periodically using Helm - Contributed by [@yonahd](https://github.com/yonahd)  
+ 
+You can scan your cluster periodically by adding a `CronJob` that will repeatedly trigger kubescape
+
+```
+helm install kubescape examples/helm_chart/
+```
+
+## Scan using docker image
+
+Official Docker image `quay.io/armosec/kubescape`
+
+```
+docker run -v "$(pwd)/example.yaml:/app/example.yaml  quay.io/armosec/kubescape scan framework nsa /app/example.yaml
+```
+
+# Submit data manually
+
+Use the `submit` command if you wish to submit data manually
+
+## Submit scan results manually
+
+First, scan your cluster using the `json` format flag: `kubescape scan framework <name> --format json --output path/to/results.json`.
+
+Now you can submit the results to the Kubaescape SaaS version -
+```
+kubescape submit results path/to/results.json
+```
 # How to build

 ## Build using python (3.7^) script

-Kubescpae can be built using:
+Kubescape can be built using:

 ``` sh
 python build.py
@@ -193,7 +268,9 @@ go build -o kubescape .

 4. Enjoy :zany_face:

-## How to build in Docker
+## Docker Build
+
+### Build your own Docker image

 1. Clone Project
 ```
@@ -205,10 +282,11 @@ git clone https://github.com/armosec/kubescape.git kubescape && cd "$_"
 docker build -t kubescape -f build/Dockerfile .
 ```

+
 # Under the hood

 ## Tests
-Kubescape is running the following tests according to what is defined by [Kubernetes Hardening Guidance by NSA and CISA](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/)
+Kubescape is running the following tests according to what is defined by [Kubernetes Hardening Guidance by NSA and CISA](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/)
 * Non-root containers
 * Immutable container filesystem
 * Privileged containers
--- a/build.py
+++ b/build.py
@@ -41,7 +41,7 @@ def main():

    # Set some variables
    packageName = getPackageName()
-    buildUrl = "github.com/armosec/kubescape/cmd.BuildNumber"
+    buildUrl = "github.com/armosec/kubescape/cautils.BuildNumber"
    releaseVersion = os.getenv("RELEASE")
    ArmoBEServer = os.getenv("ArmoBEServer")
    ArmoERServer = os.getenv("ArmoERServer")
@@ -60,9 +60,6 @@ def main():
    status = subprocess.call(["go", "build", "-o", "%s/%s" % (buildDir, packageName), "-ldflags" ,ldflags])
    checkStatus(status, "Failed to build kubescape")
    
-    test_cli_prints(buildDir,packageName)
-
-
    sha1 = hashlib.sha1()
    with open(buildDir + "/" + packageName, "rb") as kube:
        sha1.update(kube.read())
@@ -70,13 +67,7 @@ def main():
            kube_sha.write(sha1.hexdigest())

    print("Build Done")
-
-def test_cli_prints(buildDir,packageName):
-    bin_cli = os.path.abspath(os.path.join(buildDir,packageName))
-
-    print(f"testing CLI prints on {bin_cli}")
-    status = str(subprocess.check_output([bin_cli, "-h"]))
-    assert "download" in status, "download is missing: " + status    
-
+ 
+ 
 if __name__ == "__main__":
    main()
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,5 +1,10 @@
 FROM golang:1.17-alpine as builder
 #ENV GOPROXY=https://goproxy.io,direct
+
+ARG run_number
+
+ENV RELEASE=v1.0.${run_number}
+
 ENV GO111MODULE=

 ENV CGO_ENABLED=0
@@ -24,4 +29,4 @@ COPY --from=builder /work/build/ubuntu-latest/kubescape /usr/bin/kubescape
 # # Download the frameworks. Use the "--use-default" flag when running kubescape
 # RUN kubescape download framework nsa && kubescape download framework mitre

-CMD ["kubescape"]
+ENTRYPOINT ["kubescape"]
--- a/cautils/customerloader.go
+++ b/cautils/customerloader.go
@@ -4,14 +4,13 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"net/url"
 	"os"
 	"strings"

-	"github.com/armosec/kubescape/cautils/getter"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

 	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/cautils/getter"
 	corev1 "k8s.io/api/core/v1"
 )

@@ -57,80 +56,89 @@ func (co *ConfigObj) Config() []byte {
 // ======================================================================================
 // =============================== interface ============================================
 // ======================================================================================
-type IClusterConfig interface {
-
+type ITenantConfig interface {
 	// set
-	SetConfig(customerGUID string) error
+	SetTenant() error

 	// getters
 	GetClusterName() string
 	GetCustomerGUID() string
 	GetConfigObj() *ConfigObj
-	GetK8sAPI() *k8sinterface.KubernetesApi
-	GetBackendAPI() getter.IBackend
-	GetDefaultNS() string
-	GenerateURL()
-}
+	// GetBackendAPI() getter.IBackend
+	// GenerateURL()

-// ClusterConfigSetup - Setup the desired cluster behavior regarding submittion to the Armo BE
-func ClusterConfigSetup(scanInfo *ScanInfo, k8s *k8sinterface.KubernetesApi, beAPI getter.IBackend) IClusterConfig {
-	/*
-
-		If "First run (local config not found)" -
-			Default - Do not send report (local)
-			Local - Do not send report
-			Submit - Create tenant & Submit report
-
-		If "Submitted but not signed up" -
-			Default	- Delete local config & Do not send report (local)
-			Local - Delete local config & Do not send report
-			Submit - Submit report
-
-		If "Signed up user" -
-			Default	- Submit report (submit)
-			Local - Do not send report
-			Submit - Submit report
-
-	*/
-	clusterConfig := NewClusterConfig(k8s, beAPI)
-	clusterConfig.LoadConfig()
-
-	if !IsSubmitted(clusterConfig) {
-		if scanInfo.Submit {
-			return clusterConfig // submit - Create tenant & Submit report
-		}
-		return NewEmptyConfig() // local/default - Do not send report
-	}
-	if !IsRegistered(clusterConfig) {
-		if scanInfo.Submit {
-			return clusterConfig // submit/default - Submit report
-		}
-		DeleteConfig(k8s)
-		return NewEmptyConfig() // local - Delete local config & Do not send report
-	}
-	if scanInfo.Local {
-		return NewEmptyConfig() // local - Do not send report
-	}
-	return clusterConfig // submit/default -  Submit report
+	IsConfigFound() bool
 }

 // ======================================================================================
-// ============================= Mock Config ============================================
+// ============================ Local Config ============================================
 // ======================================================================================
-type EmptyConfig struct {
+// Config when scanning YAML files or URL but not a Kubernetes cluster
+type LocalConfig struct {
+	backendAPI getter.IBackend
+	configObj  *ConfigObj
 }

-func NewEmptyConfig() *EmptyConfig                            { return &EmptyConfig{} }
-func (c *EmptyConfig) SetConfig(customerGUID string) error    { return nil }
-func (c *EmptyConfig) GetConfigObj() *ConfigObj               { return &ConfigObj{} }
-func (c *EmptyConfig) GetCustomerGUID() string                { return "" }
-func (c *EmptyConfig) GetK8sAPI() *k8sinterface.KubernetesApi { return nil } // TODO: return mock obj
-func (c *EmptyConfig) GetDefaultNS() string                   { return k8sinterface.GetDefaultNamespace() }
-func (c *EmptyConfig) GetBackendAPI() getter.IBackend         { return nil } // TODO: return mock obj
-func (c *EmptyConfig) GetClusterName() string                 { return k8sinterface.GetClusterName() }
-func (c *EmptyConfig) GenerateURL() {
-	message := fmt.Sprintf("\nCheckout for more cool features: https://%s\n", getter.GetArmoAPIConnector().GetFrontendURL())
-	InfoTextDisplay(os.Stdout, fmt.Sprintf("\n%s\n", message))
+func NewLocalConfig(backendAPI getter.IBackend, customerGUID string) *LocalConfig {
+	var configObj *ConfigObj
+
+	lc := &LocalConfig{
+		backendAPI: backendAPI,
+		configObj:  &ConfigObj{},
+	}
+	// get from configMap
+	if existsConfigFile() { // get from file
+		configObj, _ = loadConfigFromFile()
+	} else {
+		configObj = &ConfigObj{}
+	}
+	if configObj != nil {
+		lc.configObj = configObj
+	}
+	if customerGUID != "" {
+		lc.configObj.CustomerGUID = customerGUID // override config customerGUID
+	}
+	if lc.configObj.CustomerGUID != "" {
+		if err := lc.SetTenant(); err != nil {
+			fmt.Println(err)
+		}
+	}
+
+	return lc
+}
+
+func (lc *LocalConfig) GetConfigObj() *ConfigObj { return lc.configObj }
+func (lc *LocalConfig) GetCustomerGUID() string  { return lc.configObj.CustomerGUID }
+func (lc *LocalConfig) GetClusterName() string   { return "" }
+func (lc *LocalConfig) IsConfigFound() bool      { return existsConfigFile() }
+func (lc *LocalConfig) SetTenant() error {
+	// ARMO tenant GUID
+	if err := getTenantConfigFromBE(lc.backendAPI, lc.configObj); err != nil {
+		return err
+	}
+	updateConfigFile(lc.configObj)
+	return nil
+
+}
+
+func getTenantConfigFromBE(backendAPI getter.IBackend, configObj *ConfigObj) error {
+
+	// get from armoBE
+	tenantResponse, err := backendAPI.GetCustomerGUID(configObj.CustomerGUID)
+	if err == nil && tenantResponse != nil {
+		if tenantResponse.AdminMail != "" { // registered tenant
+			configObj.CustomerAdminEMail = tenantResponse.AdminMail
+		} else { // new tenant
+			configObj.Token = tenantResponse.Token
+			configObj.CustomerGUID = tenantResponse.TenantID
+		}
+	} else {
+		if err != nil && !strings.Contains(err.Error(), "already exists") {
+			return err
+		}
+	}
+
+	return nil
 }

 // ======================================================================================
@@ -144,119 +152,67 @@ type ClusterConfig struct {
 	configObj  *ConfigObj
 }

-func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBackend) *ClusterConfig {
-	return &ClusterConfig{
+func NewClusterConfig(k8s *k8sinterface.KubernetesApi, backendAPI getter.IBackend, customerGUID string) *ClusterConfig {
+	defaultNS := k8sinterface.GetDefaultNamespace()
+	var configObj *ConfigObj
+	c := &ClusterConfig{
 		k8s:        k8s,
 		backendAPI: backendAPI,
 		configObj:  &ConfigObj{},
-		defaultNS:  k8sinterface.GetDefaultNamespace(),
-	}
-}
-func (c *ClusterConfig) GetConfigObj() *ConfigObj               { return c.configObj }
-func (c *ClusterConfig) GetK8sAPI() *k8sinterface.KubernetesApi { return c.k8s }
-func (c *ClusterConfig) GetDefaultNS() string                   { return c.defaultNS }
-func (c *ClusterConfig) GetBackendAPI() getter.IBackend         { return c.backendAPI }
-
-func (c *ClusterConfig) GenerateURL() {
-
-	u := url.URL{}
-	u.Scheme = "https"
-	u.Host = getter.GetArmoAPIConnector().GetFrontendURL()
-	if c.configObj == nil {
-		return
-	}
-	message := fmt.Sprintf("\nCheckout for more cool features: https://%s\n", getter.GetArmoAPIConnector().GetFrontendURL())
-	if c.configObj.CustomerAdminEMail != "" {
-		InfoTextDisplay(os.Stdout, message+"\n")
-		return
-	}
-	u.Path = "account/sign-up"
-	q := u.Query()
-	q.Add("invitationToken", c.configObj.Token)
-	q.Add("customerGUID", c.configObj.CustomerGUID)
-
-	u.RawQuery = q.Encode()
-	InfoTextDisplay(os.Stdout, message+"\n")
-
-}
-
-func (c *ClusterConfig) GetCustomerGUID() string {
-	if c.configObj != nil {
-		return c.configObj.CustomerGUID
-	}
-	return ""
-}
-
-func (c *ClusterConfig) SetConfig(customerGUID string) error {
-	if c.configObj == nil {
-		c.configObj = &ConfigObj{}
+		defaultNS:  defaultNS,
 	}

-	// cluster name
-	if c.GetClusterName() == "" {
-		c.setClusterName(k8sinterface.GetClusterName())
+	// get from configMap
+	if existsConfigMap(k8s, defaultNS) {
+		configObj, _ = loadConfigFromConfigMap(k8s, defaultNS)
+	} else if existsConfigFile() { // get from file
+		configObj, _ = loadConfigFromFile()
 	}
-
-	// ARMO customer GUID
-	if customerGUID != "" && c.GetCustomerGUID() != customerGUID {
-		c.setCustomerGUID(customerGUID) // override config customerGUID
+	if configObj != nil {
+		c.configObj = configObj
 	}
-
-	customerGUID = c.GetCustomerGUID()
-
-	// get from armoBE
-	tenantResponse, err := c.backendAPI.GetCustomerGUID(customerGUID)
-	if err == nil && tenantResponse != nil {
-		if tenantResponse.AdminMail != "" { // this customer already belongs to some user
-			c.setCustomerAdminEMail(tenantResponse.AdminMail)
-		} else {
-			c.setToken(tenantResponse.Token)
-			c.setCustomerGUID(tenantResponse.TenantID)
-		}
-	} else {
-		if err != nil && !strings.Contains(err.Error(), "already exists") {
-			return err
+	if customerGUID != "" {
+		c.configObj.CustomerGUID = customerGUID // override config customerGUID
+	}
+	if c.configObj.CustomerGUID != "" {
+		if err := c.SetTenant(); err != nil {
+			fmt.Println(err)
 		}
 	}
+	if c.configObj.ClusterName == "" {
+		c.configObj.ClusterName = adoptClusterName(k8sinterface.GetClusterName())
+	}

+	return c
+}
+
+func (c *ClusterConfig) GetConfigObj() *ConfigObj { return c.configObj }
+func (c *ClusterConfig) GetDefaultNS() string     { return c.defaultNS }
+func (c *ClusterConfig) GetCustomerGUID() string  { return c.configObj.CustomerGUID }
+func (c *ClusterConfig) IsConfigFound() bool {
+	return existsConfigFile() || existsConfigMap(c.k8s, c.defaultNS)
+}
+
+func (c *ClusterConfig) SetTenant() error {
+
+	// ARMO tenant GUID
+	if err := getTenantConfigFromBE(c.backendAPI, c.configObj); err != nil {
+		return err
+	}
 	// update/create config
-	if c.existsConfigMap() {
+	if existsConfigMap(c.k8s, c.defaultNS) {
 		c.updateConfigMap()
 	} else {
 		c.createConfigMap()
 	}
-	c.updateConfigFile()
-
+	updateConfigFile(c.configObj)
 	return nil
+
 }

-func (c *ClusterConfig) setToken(token string) {
-	c.configObj.Token = token
-}
-
-func (c *ClusterConfig) setCustomerAdminEMail(customerAdminEMail string) {
-	c.configObj.CustomerAdminEMail = customerAdminEMail
-}
-func (c *ClusterConfig) setCustomerGUID(customerGUID string) {
-	c.configObj.CustomerGUID = customerGUID
-}
-
-func (c *ClusterConfig) setClusterName(clusterName string) {
-	c.configObj.ClusterName = clusterName
-}
 func (c *ClusterConfig) GetClusterName() string {
 	return c.configObj.ClusterName
 }
-func (c *ClusterConfig) LoadConfig() {
-	// get from configMap
-	if c.existsConfigMap() {
-		c.configObj, _ = c.loadConfigFromConfigMap()
-	} else if existsConfigFile() { // get from file
-		c.configObj, _ = loadConfigFromFile()
-	} else {
-		c.configObj = &ConfigObj{}
-	}
-}

 func (c *ClusterConfig) ToMapString() map[string]interface{} {
 	m := map[string]interface{}{}
@@ -265,11 +221,8 @@ func (c *ClusterConfig) ToMapString() map[string]interface{} {
 	}
 	return m
 }
-func (c *ClusterConfig) loadConfigFromConfigMap() (*ConfigObj, error) {
-	if c.k8s == nil {
-		return nil, nil
-	}
-	configMap, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.defaultNS).Get(context.Background(), configMapName, metav1.GetOptions{})
+func loadConfigFromConfigMap(k8s *k8sinterface.KubernetesApi, ns string) (*ConfigObj, error) {
+	configMap, err := k8s.KubernetesClient.CoreV1().ConfigMaps(ns).Get(context.Background(), configMapName, metav1.GetOptions{})
 	if err != nil {
 		return nil, err
 	}
@@ -280,8 +233,8 @@ func (c *ClusterConfig) loadConfigFromConfigMap() (*ConfigObj, error) {
 	return nil, nil
 }

-func (c *ClusterConfig) existsConfigMap() bool {
-	_, err := c.k8s.KubernetesClient.CoreV1().ConfigMaps(c.defaultNS).Get(context.Background(), configMapName, metav1.GetOptions{})
+func existsConfigMap(k8s *k8sinterface.KubernetesApi, ns string) bool {
+	_, err := k8s.KubernetesClient.CoreV1().ConfigMaps(ns).Get(context.Background(), configMapName, metav1.GetOptions{})
 	// TODO - check if has customerGUID
 	return err == nil
 }
@@ -400,8 +353,8 @@ func (c *ClusterConfig) updateConfigMap() error {
 	return err
 }

-func (c *ClusterConfig) updateConfigFile() error {
-	if err := os.WriteFile(ConfigFileFullPath(), c.configObj.Config(), 0664); err != nil {
+func updateConfigFile(configObj *ConfigObj) error {
+	if err := os.WriteFile(ConfigFileFullPath(), configObj.Config(), 0664); err != nil {
 		return err
 	}
 	return nil
@@ -438,12 +391,12 @@ func readConfig(dat []byte) (*ConfigObj, error) {
 }

 // Check if the customer is submitted
-func IsSubmitted(clusterConfig *ClusterConfig) bool {
-	return clusterConfig.existsConfigMap() || existsConfigFile()
+func (clusterConfig *ClusterConfig) IsSubmitted() bool {
+	return existsConfigMap(clusterConfig.k8s, clusterConfig.defaultNS) || existsConfigFile()
 }

 // Check if the customer is registered
-func IsRegistered(clusterConfig *ClusterConfig) bool {
+func (clusterConfig *ClusterConfig) IsRegistered() bool {

 	// get from armoBE
 	tenantResponse, err := clusterConfig.backendAPI.GetCustomerGUID(clusterConfig.GetCustomerGUID())
@@ -455,8 +408,8 @@ func IsRegistered(clusterConfig *ClusterConfig) bool {
 	return false
 }

-func DeleteConfig(k8s *k8sinterface.KubernetesApi) error {
-	if err := DeleteConfigMap(k8s); err != nil {
+func (clusterConfig *ClusterConfig) DeleteConfig() error {
+	if err := DeleteConfigMap(clusterConfig.k8s); err != nil {
 		return err
 	}
 	if err := DeleteConfigFile(); err != nil {
@@ -471,3 +424,7 @@ func DeleteConfigMap(k8s *k8sinterface.KubernetesApi) error {
 func DeleteConfigFile() error {
 	return os.Remove(ConfigFileFullPath())
 }
+
+func adoptClusterName(clusterName string) string {
+	return strings.ReplaceAll(clusterName, "/", "-")
+}
--- a/cautils/datastructures.go
+++ b/cautils/datastructures.go
@@ -2,23 +2,27 @@ package cautils

 import (
 	"github.com/armosec/armoapi-go/armotypes"
+	"github.com/armosec/k8s-interface/workloadinterface"
 	"github.com/armosec/opa-utils/reporthandling"
 )

-// K8SResources map[<api group>/<api version>/<resource>]<resource object>
-type K8SResources map[string]interface{}
+// K8SResources map[<api group>/<api version>/<resource>][]<resourceID>
+type K8SResources map[string][]string

 type OPASessionObj struct {
-	Frameworks    []reporthandling.Framework
-	K8SResources  *K8SResources
-	Exceptions    []armotypes.PostureExceptionPolicy
-	PostureReport *reporthandling.PostureReport
+	K8SResources  *K8SResources                          // input k8s objects
+	Frameworks    []reporthandling.Framework             // list of frameworks to scan
+	AllResources  map[string]workloadinterface.IMetadata // all scanned resources, map[<rtesource ID>]<resource>
+	PostureReport *reporthandling.PostureReport          // scan results
+	Exceptions    []armotypes.PostureExceptionPolicy     // list of exceptions to apply on scan results
+	RegoInputData RegoInputData                          // input passed to rgo for scanning. map[<control name>][<input arguments>]
 }

 func NewOPASessionObj(frameworks []reporthandling.Framework, k8sResources *K8SResources) *OPASessionObj {
 	return &OPASessionObj{
 		Frameworks:   frameworks,
 		K8SResources: k8sResources,
+		AllResources: make(map[string]workloadinterface.IMetadata),
 		PostureReport: &reporthandling.PostureReport{
 			ClusterName:  ClusterName,
 			CustomerGUID: CustomerGUID,
@@ -30,6 +34,7 @@ func NewOPASessionObjMock() *OPASessionObj {
 	return &OPASessionObj{
 		Frameworks:   nil,
 		K8SResources: nil,
+		AllResources: make(map[string]workloadinterface.IMetadata),
 		PostureReport: &reporthandling.PostureReport{
 			ClusterName:  "",
 			CustomerGUID: "",
@@ -49,3 +54,9 @@ type Exception struct {
 	Namespaces    []string                   `json:"namespaces"`
 	Regex         string                     `json:"regex"` // not supported
 }
+
+type RegoInputData struct {
+	PostureControlInputs map[string][]string `json:"postureControlInputs"`
+	// ClusterName          string              `json:"clusterName"`
+	// K8sConfig            RegoK8sConfig       `json:"k8sconfig"`
+}
--- a/cautils/datastructuresmethods.go
+++ b/cautils/datastructuresmethods.go
@@ -0,0 +1,26 @@
+package cautils
+
+import (
+	"encoding/json"
+
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/util"
+)
+
+func (data *RegoInputData) SetControlsInputs(controlsInputs map[string][]string) {
+	data.PostureControlInputs = controlsInputs
+}
+
+func (data *RegoInputData) TOStorage() (storage.Store, error) {
+	var jsonObj map[string]interface{}
+	bytesData, err := json.Marshal(*data)
+	if err != nil {
+		return nil, err
+	}
+	// glog.Infof("RegoDependenciesData: %s", bytesData)
+	if err := util.UnmarshalJSON(bytesData, &jsonObj); err != nil {
+		return nil, err
+	}
+	return inmem.NewFromObject(jsonObj), nil
+}
--- a/cautils/getter/armoapi.go
+++ b/cautils/getter/armoapi.go
@@ -1,8 +1,10 @@
 package getter

 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 	"time"

 	"github.com/armosec/armoapi-go/armotypes"
@@ -23,15 +25,16 @@ var (

 	armoDevERURL = "report.eudev3.cyberarmorsoft.com"
 	armoDevBEURL = "eggdashbe.eudev3.cyberarmorsoft.com"
-	armoDevFEURL = "armoui.eudev3.cyberarmorsoft.com"
+	armoDevFEURL = "armoui-dev.eudev3.cyberarmorsoft.com"
 )

 // Armo API for downloading policies
 type ArmoAPI struct {
-	httpClient *http.Client
-	apiURL     string
-	erURL      string
-	feURL      string
+	httpClient   *http.Client
+	apiURL       string
+	erURL        string
+	feURL        string
+	customerGUID string
 }

 var globalArmoAPIConnecctor *ArmoAPI
@@ -82,7 +85,10 @@ func newArmoAPI() *ArmoAPI {
 		httpClient: &http.Client{Timeout: time.Duration(61) * time.Second},
 	}
 }
+func (armoAPI *ArmoAPI) SetCustomerGUID(customerGUID string) {
+	armoAPI.customerGUID = customerGUID

+}
 func (armoAPI *ArmoAPI) GetFrontendURL() string {
 	return armoAPI.feURL
 }
@@ -92,7 +98,7 @@ func (armoAPI *ArmoAPI) GetReportReceiverURL() string {
 }

 func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, error) {
-	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getFrameworkURL(name))
+	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getFrameworkURL(name), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -106,12 +112,16 @@ func (armoAPI *ArmoAPI) GetFramework(name string) (*reporthandling.Framework, er
 	return framework, err
 }

+func (armoAPI *ArmoAPI) GetControl(policyName string) (*reporthandling.Control, error) {
+	return nil, fmt.Errorf("control api is not public")
+}
+
 func (armoAPI *ArmoAPI) GetExceptions(customerGUID, clusterName string) ([]armotypes.PostureExceptionPolicy, error) {
 	exceptions := []armotypes.PostureExceptionPolicy{}
 	if customerGUID == "" {
 		return exceptions, nil
 	}
-	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getExceptionsURL(customerGUID, clusterName))
+	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getExceptionsURL(customerGUID, clusterName), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -128,7 +138,7 @@ func (armoAPI *ArmoAPI) GetCustomerGUID(customerGUID string) (*TenantResponse, e
 	if customerGUID != "" {
 		url = fmt.Sprintf("%s?customerGUID=%s", url, customerGUID)
 	}
-	respStr, err := HttpGetter(armoAPI.httpClient, url)
+	respStr, err := HttpGetter(armoAPI.httpClient, url, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -140,6 +150,75 @@ func (armoAPI *ArmoAPI) GetCustomerGUID(customerGUID string) (*TenantResponse, e
 	return tenant, nil
 }

+// ControlsInputs  // map[<control name>][<input arguments>]
+func (armoAPI *ArmoAPI) GetAccountConfig(customerGUID, clusterName string) (*armotypes.CustomerConfig, error) {
+	accountConfig := &armotypes.CustomerConfig{}
+	if customerGUID == "" {
+		return accountConfig, nil
+	}
+	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getAccountConfig(customerGUID, clusterName), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = JSONDecoder(respStr).Decode(&accountConfig); err != nil {
+		return nil, err
+	}
+
+	return accountConfig, nil
+}
+
+// ControlsInputs  // map[<control name>][<input arguments>]
+func (armoAPI *ArmoAPI) GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) {
+	accountConfig, err := armoAPI.GetAccountConfig(customerGUID, clusterName)
+	if err == nil {
+		return accountConfig.Settings.PostureControlInputs, nil
+	}
+	return nil, err
+}
+
+func (armoAPI *ArmoAPI) ListCustomFrameworks(customerGUID string) ([]string, error) {
+	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getListFrameworkURL(), nil)
+	if err != nil {
+		return nil, err
+	}
+	frs := []reporthandling.Framework{}
+	if err = json.Unmarshal([]byte(respStr), &frs); err != nil {
+		return nil, err
+	}
+
+	frameworkList := []string{}
+	for _, fr := range frs {
+		if !isNativeFramework(fr.Name) {
+			frameworkList = append(frameworkList, fr.Name)
+		}
+	}
+
+	return frameworkList, nil
+}
+
+func (armoAPI *ArmoAPI) ListFrameworks(customerGUID string) ([]string, error) {
+	respStr, err := HttpGetter(armoAPI.httpClient, armoAPI.getListFrameworkURL(), nil)
+	if err != nil {
+		return nil, err
+	}
+	frs := []reporthandling.Framework{}
+	if err = json.Unmarshal([]byte(respStr), &frs); err != nil {
+		return nil, err
+	}
+
+	frameworkList := []string{}
+	for _, fr := range frs {
+		if isNativeFramework(fr.Name) {
+			frameworkList = append(frameworkList, strings.ToLower(fr.Name))
+		} else {
+			frameworkList = append(frameworkList, fr.Name)
+		}
+	}
+
+	return frameworkList, nil
+}
+
 type TenantResponse struct {
 	TenantID  string `json:"tenantId"`
 	Token     string `json:"token"`
--- a/cautils/getter/armoapiutils.go
+++ b/cautils/getter/armoapiutils.go
@@ -5,20 +5,37 @@ import (
 	"strings"
 )

+var NativeFrameworks = []string{"nsa", "mitre", "armobest"}
+
 func (armoAPI *ArmoAPI) getFrameworkURL(frameworkName string) string {
 	u := url.URL{}
 	u.Scheme = "https"
 	u.Host = armoAPI.apiURL
-	u.Path = "v1/armoFrameworks"
+	u.Path = "api/v1/armoFrameworks"
 	q := u.Query()
-	q.Add("customerGUID", "11111111-1111-1111-1111-111111111111")
-	q.Add("frameworkName", strings.ToUpper(frameworkName))
-	q.Add("getRules", "true")
+	q.Add("customerGUID", armoAPI.customerGUID)
+	if isNativeFramework(frameworkName) {
+		q.Add("frameworkName", strings.ToUpper(frameworkName))
+	} else {
+		// For customer framework has to be the way it was added
+		q.Add("frameworkName", frameworkName)
+	}
 	u.RawQuery = q.Encode()

 	return u.String()
 }

+func (armoAPI *ArmoAPI) getListFrameworkURL() string {
+	u := url.URL{}
+	u.Scheme = "https"
+	u.Host = armoAPI.apiURL
+	u.Path = "api/v1/armoFrameworks"
+	q := u.Query()
+	q.Add("customerGUID", armoAPI.customerGUID)
+	u.RawQuery = q.Encode()
+
+	return u.String()
+}
 func (armoAPI *ArmoAPI) getExceptionsURL(customerGUID, clusterName string) string {
 	u := url.URL{}
 	u.Scheme = "https"
@@ -35,6 +52,22 @@ func (armoAPI *ArmoAPI) getExceptionsURL(customerGUID, clusterName string) strin
 	return u.String()
 }

+func (armoAPI *ArmoAPI) getAccountConfig(customerGUID, clusterName string) string {
+	u := url.URL{}
+	u.Scheme = "https"
+	u.Host = armoAPI.apiURL
+	u.Path = "api/v1/armoCustomerConfiguration"
+
+	q := u.Query()
+	q.Add("customerGUID", customerGUID)
+	if clusterName != "" { // TODO - fix customer name support in Armo BE
+		q.Add("clusterName", clusterName)
+	}
+	u.RawQuery = q.Encode()
+
+	return u.String()
+}
+
 func (armoAPI *ArmoAPI) getCustomerURL() string {
 	u := url.URL{}
 	u.Scheme = "https"
--- a/cautils/getter/downloadreleasedpolicy.go
+++ b/cautils/getter/downloadreleasedpolicy.go
@@ -11,26 +11,22 @@ import (
 // ======================================== DownloadReleasedPolicy =======================================================
 // =======================================================================================================================

-// Download released version
+// Use gitregostore to get policies from github release
 type DownloadReleasedPolicy struct {
 	gs *gitregostore.GitRegoStore
 }

 func NewDownloadReleasedPolicy() *DownloadReleasedPolicy {
 	return &DownloadReleasedPolicy{
-		gs: gitregostore.InitDefaultGitRegoStore(),
+		gs: gitregostore.NewDefaultGitRegoStore(-1),
 	}
 }

-// Return control per name/id using ARMO api
 func (drp *DownloadReleasedPolicy) GetControl(policyName string) (*reporthandling.Control, error) {
 	var control *reporthandling.Control
 	var err error
-	if strings.HasPrefix(policyName, "C-") || strings.HasPrefix(policyName, "c-") {
-		control, err = drp.gs.GetOPAControlByID(policyName)
-	} else {
-		control, err = drp.gs.GetOPAControlByName(policyName)
-	}
+
+	control, err = drp.gs.GetOPAControl(policyName)
 	if err != nil {
 		return nil, err
 	}
@@ -44,3 +40,20 @@ func (drp *DownloadReleasedPolicy) GetFramework(name string) (*reporthandling.Fr
 	}
 	return framework, err
 }
+
+func (drp *DownloadReleasedPolicy) SetRegoObjects() error {
+	return drp.gs.SetRegoObjects()
+}
+
+func isNativeFramework(framework string) bool {
+	return contains(NativeFrameworks, framework)
+}
+
+func contains(s []string, str string) bool {
+	for _, v := range s {
+		if strings.EqualFold(v, str) {
+			return true
+		}
+	}
+	return false
+}
--- a/cautils/getter/getpolicies.go
+++ b/cautils/getter/getpolicies.go
@@ -7,7 +7,7 @@ import (

 type IPolicyGetter interface {
 	GetFramework(name string) (*reporthandling.Framework, error)
-	GetControl(policyName string) (*reporthandling.Control, error)
+	GetControl(name string) (*reporthandling.Control, error)
 }

 type IExceptionsGetter interface {
@@ -16,3 +16,7 @@ type IExceptionsGetter interface {
 type IBackend interface {
 	GetCustomerGUID(customerGUID string) (*TenantResponse, error)
 }
+
+type IControlsInputsGetter interface {
+	GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error)
+}
--- a/cautils/getter/getpoliciesutils.go
+++ b/cautils/getter/getpoliciesutils.go
@@ -1,6 +1,7 @@
 package getter

 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -77,12 +78,14 @@ func JSONDecoder(origin string) *json.Decoder {
 	return dec
 }

-func HttpGetter(httpClient *http.Client, fullURL string) (string, error) {
+func HttpGetter(httpClient *http.Client, fullURL string, headers map[string]string) (string, error) {

 	req, err := http.NewRequest("GET", fullURL, nil)
 	if err != nil {
 		return "", err
 	}
+	addHeaders(req, headers)
+
 	resp, err := httpClient.Do(req)
 	if err != nil {
 		return "", err
@@ -94,6 +97,32 @@ func HttpGetter(httpClient *http.Client, fullURL string) (string, error) {
 	return respStr, nil
 }

+func HttpPost(httpClient *http.Client, fullURL string, headers map[string]string, body []byte) (string, error) {
+
+	req, err := http.NewRequest("POST", fullURL, bytes.NewReader(body))
+	if err != nil {
+		return "", err
+	}
+	addHeaders(req, headers)
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	respStr, err := httpRespToString(resp)
+	if err != nil {
+		return "", err
+	}
+	return respStr, nil
+}
+
+func addHeaders(req *http.Request, headers map[string]string) {
+	if len(headers) >= 0 { // might be nil
+		for k, v := range headers {
+			req.Header.Add(k, v)
+		}
+	}
+}
+
 // HTTPRespToString parses the body as string and checks the HTTP status code, it closes the body reader at the end
 func httpRespToString(resp *http.Response) (string, error) {
 	if resp == nil || resp.Body == nil {
--- a/cautils/getter/loadpolicy.go
+++ b/cautils/getter/loadpolicy.go
@@ -17,12 +17,12 @@ const DefaultLocalStore = ".kubescape"

 // Load policies from a local repository
 type LoadPolicy struct {
-	filePath string
+	filePaths []string
 }

-func NewLoadPolicy(filePath string) *LoadPolicy {
+func NewLoadPolicy(filePaths []string) *LoadPolicy {
 	return &LoadPolicy{
-		filePath: filePath,
+		filePaths: filePaths,
 	}
 }

@@ -30,37 +30,58 @@ func NewLoadPolicy(filePath string) *LoadPolicy {
 func (lp *LoadPolicy) GetControl(controlName string) (*reporthandling.Control, error) {

 	control := &reporthandling.Control{}
-	f, err := os.ReadFile(lp.filePath)
+	filePath := lp.filePath()
+	f, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, err
 	}

-	err = json.Unmarshal(f, control)
+	if err = json.Unmarshal(f, control); err != nil {
+		return control, err
+	}
 	if controlName != "" && !strings.EqualFold(controlName, control.Name) && !strings.EqualFold(controlName, control.ControlID) {
-		return nil, fmt.Errorf("control from file not matching")
+		framework, err := lp.GetFramework(control.Name)
+		if err != nil {
+			return nil, fmt.Errorf("control from file not matching")
+		} else {
+			for _, ctrl := range framework.Controls {
+				if strings.EqualFold(ctrl.Name, controlName) || strings.EqualFold(ctrl.ControlID, controlName) {
+					control = &ctrl
+					break
+				}
+			}
+		}
 	}
 	return control, err
 }

 func (lp *LoadPolicy) GetFramework(frameworkName string) (*reporthandling.Framework, error) {
-
 	framework := &reporthandling.Framework{}
-	f, err := os.ReadFile(lp.filePath)
-	if err != nil {
-		return nil, err
-	}
+	var err error
+	for _, filePath := range lp.filePaths {
+		f, err := os.ReadFile(filePath)
+		if err != nil {
+			return nil, err
+		}

-	err = json.Unmarshal(f, framework)
+		if err = json.Unmarshal(f, framework); err != nil {
+			return framework, err
+		}
+		if strings.EqualFold(frameworkName, framework.Name) {
+			break
+		}
+	}
 	if frameworkName != "" && !strings.EqualFold(frameworkName, framework.Name) {
+
 		return nil, fmt.Errorf("framework from file not matching")
 	}
 	return framework, err
 }

 func (lp *LoadPolicy) GetExceptions(customerGUID, clusterName string) ([]armotypes.PostureExceptionPolicy, error) {
-
+	filePath := lp.filePath()
 	exception := []armotypes.PostureExceptionPolicy{}
-	f, err := os.ReadFile(lp.filePath)
+	f, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, err
 	}
@@ -68,3 +89,25 @@ func (lp *LoadPolicy) GetExceptions(customerGUID, clusterName string) ([]armotyp
 	err = json.Unmarshal(f, &exception)
 	return exception, err
 }
+
+func (lp *LoadPolicy) GetControlsInputs(customerGUID, clusterName string) (map[string][]string, error) {
+	filePath := lp.filePath()
+	accountConfig := &armotypes.CustomerConfig{}
+	f, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = json.Unmarshal(f, &accountConfig); err == nil {
+		return accountConfig.Settings.PostureControlInputs, nil
+	}
+	return nil, err
+}
+
+// temporary support for a list of files
+func (lp *LoadPolicy) filePath() string {
+	if len(lp.filePaths) > 0 {
+		return lp.filePaths[0]
+	}
+	return ""
+}
--- a/cautils/rbac.go
+++ b/cautils/rbac.go
@@ -0,0 +1,117 @@
+package cautils
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/opa-utils/reporthandling"
+	"github.com/armosec/rbac-utils/rbacscanner"
+	"github.com/armosec/rbac-utils/rbacutils"
+	uuid "github.com/satori/go.uuid"
+)
+
+type RBACObjects struct {
+	scanner *rbacscanner.RbacScannerFromK8sAPI
+}
+
+func NewRBACObjects(scanner *rbacscanner.RbacScannerFromK8sAPI) *RBACObjects {
+	return &RBACObjects{scanner: scanner}
+}
+
+func (rbacObjects *RBACObjects) SetResourcesReport() (*reporthandling.PostureReport, error) {
+	return &reporthandling.PostureReport{
+		ReportID:             uuid.NewV4().String(),
+		ReportGenerationTime: time.Now().UTC(),
+		CustomerGUID:         rbacObjects.scanner.CustomerGUID,
+		ClusterName:          rbacObjects.scanner.ClusterName,
+	}, nil
+}
+
+func (rbacObjects *RBACObjects) ListAllResources() (map[string]workloadinterface.IMetadata, error) {
+	resources, err := rbacObjects.scanner.ListResources()
+	if err != nil {
+		return nil, err
+	}
+	allresources, err := rbacObjects.rbacObjectsToResources(resources)
+	if err != nil {
+		return nil, err
+	}
+	return allresources, nil
+}
+
+func (rbacObjects *RBACObjects) rbacObjectsToResources(resources *rbacutils.RbacObjects) (map[string]workloadinterface.IMetadata, error) {
+	allresources := map[string]workloadinterface.IMetadata{}
+	// wrap rbac aggregated objects in IMetadata and add to allresources
+	rbacIMeta, err := rbacutils.RbacObjectIMetadataWrapper(resources.Rbac)
+	if err != nil {
+		return nil, err
+	}
+	allresources[rbacIMeta.GetID()] = rbacIMeta
+	rbacTableIMeta, err := rbacutils.RbacTableObjectIMetadataWrapper(resources.RbacT)
+	if err != nil {
+		return nil, err
+	}
+	allresources[rbacTableIMeta.GetID()] = rbacTableIMeta
+	SA2WLIDmapIMeta, err := rbacutils.SA2WLIDmapIMetadataWrapper(resources.SA2WLIDmap)
+	if err != nil {
+		return nil, err
+	}
+	allresources[SA2WLIDmapIMeta.GetID()] = SA2WLIDmapIMeta
+
+	// convert rbac k8s resources to IMetadata and add to allresources
+	for _, cr := range resources.ClusterRoles.Items {
+		crmap, err := convertToMap(cr)
+		if err != nil {
+			return nil, err
+		}
+		crmap["apiVersion"] = "rbac.authorization.k8s.io/v1"
+		crIMeta := workloadinterface.NewWorkloadObj(crmap)
+		crIMeta.SetKind("ClusterRole")
+		allresources[crIMeta.GetID()] = crIMeta
+	}
+	for _, cr := range resources.Roles.Items {
+		crmap, err := convertToMap(cr)
+		if err != nil {
+			return nil, err
+		}
+		crmap["apiVersion"] = "rbac.authorization.k8s.io/v1"
+		crIMeta := workloadinterface.NewWorkloadObj(crmap)
+		crIMeta.SetKind("Role")
+		allresources[crIMeta.GetID()] = crIMeta
+	}
+	for _, cr := range resources.ClusterRoleBindings.Items {
+		crmap, err := convertToMap(cr)
+		if err != nil {
+			return nil, err
+		}
+		crmap["apiVersion"] = "rbac.authorization.k8s.io/v1"
+		crIMeta := workloadinterface.NewWorkloadObj(crmap)
+		crIMeta.SetKind("ClusterRoleBinding")
+		allresources[crIMeta.GetID()] = crIMeta
+	}
+	for _, cr := range resources.RoleBindings.Items {
+		crmap, err := convertToMap(cr)
+		if err != nil {
+			return nil, err
+		}
+		crmap["apiVersion"] = "rbac.authorization.k8s.io/v1"
+		crIMeta := workloadinterface.NewWorkloadObj(crmap)
+		crIMeta.SetKind("RoleBinding")
+		allresources[crIMeta.GetID()] = crIMeta
+	}
+	return allresources, nil
+}
+
+func convertToMap(obj interface{}) (map[string]interface{}, error) {
+	var inInterface map[string]interface{}
+	inrec, err := json.Marshal(obj)
+	if err != nil {
+		return nil, err
+	}
+	err = json.Unmarshal(inrec, &inInterface)
+	if err != nil {
+		return nil, err
+	}
+	return inInterface, nil
+}
--- a/cautils/reporterutils.go
+++ b/cautils/reporterutils.go
@@ -1,5 +0,0 @@
-package cautils
-
-const (
-	ComponentIdentifier = "Posture"
-)
--- a/cautils/scaninfo.go
+++ b/cautils/scaninfo.go
@@ -1,67 +1,109 @@
 package cautils

 import (
+	"fmt"
 	"path/filepath"

-	"github.com/armosec/k8s-interface/k8sinterface"
 	"github.com/armosec/kubescape/cautils/getter"
 	"github.com/armosec/opa-utils/reporthandling"
 )

+const (
+	ScanCluster    string = "cluster"
+	ScanLocalFiles string = "yaml"
+)
+
+type BoolPtrFlag struct {
+	valPtr *bool
+}
+
+func (bpf *BoolPtrFlag) Type() string {
+	return "bool"
+}
+
+func (bpf *BoolPtrFlag) String() string {
+	if bpf.valPtr != nil {
+		return fmt.Sprintf("%v", *bpf.valPtr)
+	}
+	return ""
+}
+func (bpf *BoolPtrFlag) Get() *bool {
+	return bpf.valPtr
+}
+
+func (bpf *BoolPtrFlag) SetBool(val bool) {
+	bpf.valPtr = &val
+}
+
+func (bpf *BoolPtrFlag) Set(val string) error {
+	switch val {
+	case "true":
+		bpf.SetBool(true)
+	case "false":
+		bpf.SetBool(false)
+	}
+	return nil
+}
+
 type ScanInfo struct {
 	Getters
-	PolicyIdentifier   reporthandling.PolicyIdentifier
-	UseExceptions      string   // Load exceptions configuration
-	UseFrom            string   // Load framework from local file (instead of download). Use when running offline
-	UseDefault         bool     // Load framework from cached file (instead of download). Use when running offline
-	Format             string   // Format results (table, json, junit ...)
-	Output             string   // Store results in an output file, Output file name
-	ExcludedNamespaces string   // DEPRECATED?
-	InputPatterns      []string // Yaml files input patterns
-	Silent             bool     // Silent mode - Do not print progress logs
-	FailThreshold      uint16   // Failure score threshold
-	Submit             bool     // Submit results to Armo BE
-	Local              bool     // Do not submit results
-	Account            string   // account ID
-	FrameworkScan      bool     // false if scanning control
+	PolicyIdentifier   []reporthandling.PolicyIdentifier
+	UseExceptions      string      // Load file with exceptions configuration
+	ControlsInputs     string      // Load file with inputs for controls
+	UseFrom            []string    // Load framework from local file (instead of download). Use when running offline
+	UseDefault         bool        // Load framework from cached file (instead of download). Use when running offline
+	VerboseMode        bool        // Display all of the input resources and not only failed resources
+	Format             string      // Format results (table, json, junit ...)
+	Output             string      // Store results in an output file, Output file name
+	ExcludedNamespaces string      // used for host sensor namespace
+	IncludeNamespaces  string      // DEPRECATED?
+	InputPatterns      []string    // Yaml files input patterns
+	Silent             bool        // Silent mode - Do not print progress logs
+	FailThreshold      uint16      // Failure score threshold
+	Submit             bool        // Submit results to Armo BE
+	HostSensor         BoolPtrFlag // Deploy ARMO K8s host sensor to collect data from certain controls
+	Local              bool        // Do not submit results
+	Account            string      // account ID
+	FrameworkScan      bool        // false if scanning control
+	ScanAll            bool        // true if scan all frameworks
 }

 type Getters struct {
-	ExceptionsGetter getter.IExceptionsGetter
-	PolicyGetter     getter.IPolicyGetter
+	ExceptionsGetter     getter.IExceptionsGetter
+	ControlsInputsGetter getter.IControlsInputsGetter
+	PolicyGetter         getter.IPolicyGetter
 }

 func (scanInfo *ScanInfo) Init() {
 	scanInfo.setUseFrom()
 	scanInfo.setUseExceptions()
+	scanInfo.setAccountConfig()
 	scanInfo.setOutputFile()
-	scanInfo.setGetter()

 }

 func (scanInfo *ScanInfo) setUseExceptions() {
 	if scanInfo.UseExceptions != "" {
 		// load exceptions from file
-		scanInfo.ExceptionsGetter = getter.NewLoadPolicy(scanInfo.UseExceptions)
+		scanInfo.ExceptionsGetter = getter.NewLoadPolicy([]string{scanInfo.UseExceptions})
 	} else {
 		scanInfo.ExceptionsGetter = getter.GetArmoAPIConnector()
 	}
+}

+func (scanInfo *ScanInfo) setAccountConfig() {
+	if scanInfo.ControlsInputs != "" {
+		// load account config from file
+		scanInfo.ControlsInputsGetter = getter.NewLoadPolicy([]string{scanInfo.ControlsInputs})
+	} else {
+		scanInfo.ControlsInputsGetter = getter.GetArmoAPIConnector()
+	}
 }
 func (scanInfo *ScanInfo) setUseFrom() {
-	if scanInfo.UseFrom != "" {
-		return
-	}
 	if scanInfo.UseDefault {
-		scanInfo.UseFrom = getter.GetDefaultPath(scanInfo.PolicyIdentifier.Name + ".json")
-	}
-}
-func (scanInfo *ScanInfo) setGetter() {
-	if scanInfo.UseFrom != "" {
-		// load from file
-		scanInfo.PolicyGetter = getter.NewLoadPolicy(scanInfo.UseFrom)
-	} else {
-		scanInfo.PolicyGetter = getter.NewDownloadReleasedPolicy()
+		for _, policy := range scanInfo.PolicyIdentifier {
+			scanInfo.UseFrom = append(scanInfo.UseFrom, getter.GetDefaultPath(policy.Name+".json"))
+		}
 	}
 }

@@ -81,25 +123,29 @@ func (scanInfo *ScanInfo) setOutputFile() {
 	}
 }

-func (scanInfo *ScanInfo) ScanRunningCluster() bool {
-	return len(scanInfo.InputPatterns) == 0
-}
-
-func (scanInfo *ScanInfo) SetClusterConfig() (IClusterConfig, *k8sinterface.KubernetesApi) {
-	var clusterConfig IClusterConfig
-	var k8s *k8sinterface.KubernetesApi
-	if !scanInfo.ScanRunningCluster() {
-		k8sinterface.ConnectedToCluster = false
-		clusterConfig = NewEmptyConfig()
-	} else {
-		k8s = k8sinterface.NewKubernetesApi()
-		// setup cluster config
-		clusterConfig = ClusterConfigSetup(scanInfo, k8s, getter.GetArmoAPIConnector())
+func (scanInfo *ScanInfo) GetScanningEnvironment() string {
+	if len(scanInfo.InputPatterns) != 0 {
+		return ScanLocalFiles
 	}
-	return clusterConfig, k8s
+	return ScanCluster
 }

-// func (scanInfo *ScanInfo) ConnectedToCluster(k8s k8sinterface.) bool {
-// 	_, err := k8s.KubernetesClient.CoreV1().Pods("").List(context.TODO(), metav1.ListOptions{})
-// 	return err == nil
-// }
+func (scanInfo *ScanInfo) SetPolicyIdentifiers(policies []string, kind reporthandling.NotificationPolicyKind) {
+	for _, policy := range policies {
+		if !scanInfo.contains(policy) {
+			newPolicy := reporthandling.PolicyIdentifier{}
+			newPolicy.Kind = kind // reporthandling.KindFramework
+			newPolicy.Name = policy
+			scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
+		}
+	}
+}
+
+func (scanInfo *ScanInfo) contains(policyName string) bool {
+	for _, policy := range scanInfo.PolicyIdentifier {
+		if policy.Name == policyName {
+			return true
+		}
+	}
+	return false
+}
--- a/cautils/versioncheck.go
+++ b/cautils/versioncheck.go
@@ -0,0 +1,133 @@
+package cautils
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/armosec/kubescape/cautils/getter"
+	pkgutils "github.com/armosec/utils-go/utils"
+)
+
+const SKIP_VERSION_CHECK = "KUBESCAPE_SKIP_UPDATE_CHECK"
+
+var BuildNumber string
+
+const UnknownBuildNumber = "unknown"
+
+type IVersionCheckHandler interface {
+	CheckLatestVersion(*VersionCheckRequest) error
+}
+
+func NewIVersionCheckHandler() IVersionCheckHandler {
+	if BuildNumber == "" {
+		WarningDisplay(os.Stdout, "Warning: unknown build number, this might affect your scan results. Please make sure you are updated to latest version.\n")
+	}
+	if v, ok := os.LookupEnv(SKIP_VERSION_CHECK); ok && pkgutils.StringToBool(v) {
+		return NewVersionCheckHandlerMock()
+	}
+	return NewVersionCheckHandler()
+}
+
+type VersionCheckHandlerMock struct {
+}
+
+func NewVersionCheckHandlerMock() *VersionCheckHandlerMock {
+	return &VersionCheckHandlerMock{}
+}
+
+type VersionCheckHandler struct {
+	versionURL string
+}
+type VersionCheckRequest struct {
+	Client           string `json:"client"`           // kubescape
+	ClientVersion    string `json:"clientVersion"`    // kubescape version
+	Framework        string `json:"framework"`        // framework name
+	FrameworkVersion string `json:"frameworkVersion"` // framework version
+	ScanningTarget   string `json:"target"`           // scanning target- cluster/yaml
+}
+
+type VersionCheckResponse struct {
+	Client          string `json:"client"`          // kubescape
+	ClientUpdate    string `json:"clientUpdate"`    // kubescape latest version
+	Framework       string `json:"framework"`       // framework name
+	FrameworkUpdate string `json:"frameworkUpdate"` // framework latest version
+	Message         string `json:"message"`         // alert message
+}
+
+func NewVersionCheckHandler() *VersionCheckHandler {
+	return &VersionCheckHandler{
+		versionURL: "https://us-central1-elated-pottery-310110.cloudfunctions.net/ksgf1v1",
+	}
+}
+func NewVersionCheckRequest(buildNumber, frameworkName, frameworkVersion, scanningTarget string) *VersionCheckRequest {
+	if buildNumber == "" {
+		buildNumber = UnknownBuildNumber
+	}
+	return &VersionCheckRequest{
+		Client:           "kubescape",
+		ClientVersion:    buildNumber,
+		Framework:        frameworkName,
+		FrameworkVersion: frameworkVersion,
+		ScanningTarget:   scanningTarget,
+	}
+}
+
+func (v *VersionCheckHandlerMock) CheckLatestVersion(versionData *VersionCheckRequest) error {
+	fmt.Println("Skipping version check")
+	return nil
+}
+
+func (v *VersionCheckHandler) CheckLatestVersion(versionData *VersionCheckRequest) error {
+	defer func() {
+		if err := recover(); err != nil {
+			fmt.Println("failed to get latest version")
+		}
+	}()
+
+	latestVersion, err := v.getLatestVersion(versionData)
+	if err != nil || latestVersion == nil {
+		return fmt.Errorf("failed to get latest version")
+	}
+
+	if latestVersion.ClientUpdate != "" {
+		if BuildNumber != "" && BuildNumber < latestVersion.ClientUpdate {
+			fmt.Println(warningMessage(latestVersion.Client, latestVersion.ClientUpdate))
+		}
+	}
+
+	// TODO - Enable after supporting framework version
+	// if latestVersion.FrameworkUpdate != "" {
+	// 	fmt.Println(warningMessage(latestVersion.Framework, latestVersion.FrameworkUpdate))
+	// }
+
+	if latestVersion.Message != "" {
+		fmt.Println(latestVersion.Message)
+	}
+
+	return nil
+}
+
+func (v *VersionCheckHandler) getLatestVersion(versionData *VersionCheckRequest) (*VersionCheckResponse, error) {
+
+	reqBody, err := json.Marshal(*versionData)
+	if err != nil {
+		return nil, fmt.Errorf("in 'CheckLatestVersion' failed to json.Marshal, reason: %s", err.Error())
+	}
+
+	resp, err := getter.HttpPost(http.DefaultClient, v.versionURL, map[string]string{"Content-Type": "application/json"}, reqBody)
+	if err != nil {
+		return nil, err
+	}
+
+	vResp := &VersionCheckResponse{}
+	if err = getter.JSONDecoder(resp).Decode(vResp); err != nil {
+		return nil, err
+	}
+	return vResp, nil
+}
+
+func warningMessage(kind, release string) string {
+	return fmt.Sprintf("Warning: '%s' is not updated to the latest release: '%s'", kind, release)
+}
--- a/clihandler/cliinterfaces/submit.go
+++ b/clihandler/cliinterfaces/submit.go
@@ -0,0 +1,19 @@
+package cliinterfaces
+
+import (
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/resultshandling/reporter"
+	"github.com/armosec/opa-utils/reporthandling"
+)
+
+type ISubmitObjects interface {
+	SetResourcesReport() (*reporthandling.PostureReport, error)
+	ListAllResources() (map[string]workloadinterface.IMetadata, error)
+}
+
+type SubmitInterfaces struct {
+	SubmitObjects ISubmitObjects
+	Reporter      reporter.IReport
+	ClusterConfig cautils.ITenantConfig
+}
--- a/clihandler/cmd/cluster_get.go
+++ b/clihandler/cmd/cluster_get.go
@@ -7,7 +7,6 @@ import (
 	"github.com/armosec/k8s-interface/k8sinterface"
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/kubescape/cautils/getter"
-	"github.com/armosec/kubescape/clihandler"
 	"github.com/spf13/cobra"
 )

@@ -15,7 +14,7 @@ var getCmd = &cobra.Command{
 	Use:       "get <key>",
 	Short:     "Get configuration in cluster",
 	Long:      ``,
-	ValidArgs: clihandler.SupportedFrameworks,
+	ValidArgs: getter.NativeFrameworks,
 	Args: func(cmd *cobra.Command, args []string) error {
 		if len(args) < 1 || len(args) > 1 {
 			return fmt.Errorf("requires  one argument")
@@ -32,7 +31,7 @@ var getCmd = &cobra.Command{
 		key := keyValue[0]

 		k8s := k8sinterface.NewKubernetesApi()
-		clusterConfig := cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector())
+		clusterConfig := cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account)
 		val, err := clusterConfig.GetValueByKeyFromConfigMap(key)
 		if err != nil {
 			if err.Error() == "value does not exist." {
--- a/clihandler/cmd/cluster_set.go
+++ b/clihandler/cmd/cluster_set.go
@@ -30,7 +30,7 @@ var setCmd = &cobra.Command{
 		data := keyValue[1]

 		k8s := k8sinterface.NewKubernetesApi()
-		clusterConfig := cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector())
+		clusterConfig := cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account)
 		if err := clusterConfig.SetKeyValueInConfigmap(key, data); err != nil {
 			return err
 		}
--- a/clihandler/cmd/control.go
+++ b/clihandler/cmd/control.go
@@ -2,10 +2,12 @@ package cmd

 import (
 	"fmt"
+	"io"
 	"os"
 	"strings"

 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
 	"github.com/armosec/kubescape/clihandler"
 	"github.com/armosec/opa-utils/reporthandling"
 	"github.com/spf13/cobra"
@@ -13,25 +15,55 @@ import (

 // controlCmd represents the control command
 var controlCmd = &cobra.Command{
-	Use:   "control <control name>/<control id>",
-	Short: fmt.Sprintf("The control you wish to use for scan. It must be present in at least one of the folloiwng frameworks: %s", clihandler.ValidFrameworks),
+	Use:   "control <control names list>/<control ids list>.\nExamples:\n$ kubescape scan control C-0058,C-0057 [flags]\n$ kubescape scan contol C-0058 [flags]\n$ kubescape scan control 'privileged container,allowed hostpath' [flags]",
+	Short: fmt.Sprintf("The control you wish to use for scan. It must be present in at least one of the following frameworks: %s", getter.NativeFrameworks),
 	Args: func(cmd *cobra.Command, args []string) error {
-		if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) {
-			return fmt.Errorf("requires at least one argument")
+		if len(args) > 0 {
+			controls := strings.Split(args[0], ",")
+			if len(controls) > 1 {
+				if controls[1] == "" {
+					return fmt.Errorf("usage: <control-0>,<control-1>")
+				}
+			}
+		} else {
+			return fmt.Errorf("requires at least one control name")
 		}
 		return nil
 	},
 	RunE: func(cmd *cobra.Command, args []string) error {
 		flagValidationControl()
-		scanInfo.PolicyIdentifier = reporthandling.PolicyIdentifier{}
-		if !(cmd.Flags().Lookup("use-from").Changed) {
-			scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0])
+		scanInfo.PolicyIdentifier = []reporthandling.PolicyIdentifier{}
+
+		if len(args) == 0 {
+			scanInfo.SetPolicyIdentifiers(getter.NativeFrameworks, reporthandling.KindFramework)
+			scanInfo.ScanAll = true
+		} else { // expected control or list of control sepparated by ","
+
+			// Read controls from input args
+			scanInfo.SetPolicyIdentifiers(strings.Split(args[0], ","), reporthandling.KindControl)
+
+			if len(args) > 1 {
+				if len(args[1:]) == 0 || args[1] != "-" {
+					scanInfo.InputPatterns = args[1:]
+				} else { // store stdin to file - do NOT move to separate function !!
+					tempFile, err := os.CreateTemp(".", "tmp-kubescape*.yaml")
+					if err != nil {
+						return err
+					}
+					defer os.Remove(tempFile.Name())
+
+					if _, err := io.Copy(tempFile, os.Stdin); err != nil {
+						return err
+					}
+					scanInfo.InputPatterns = []string{tempFile.Name()}
+				}
+			}
 		}
+
 		scanInfo.FrameworkScan = false
-		scanInfo.PolicyIdentifier.Kind = reporthandling.KindControl
 		scanInfo.Init()
 		cautils.SetSilentMode(scanInfo.Silent)
-		err := clihandler.CliSetup(scanInfo)
+		err := clihandler.ScanCliSetup(&scanInfo)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "error: %v\n", err)
 			os.Exit(1)
@@ -51,3 +83,22 @@ func flagValidationControl() {
 		os.Exit(1)
 	}
 }
+
+func setScanForFirstControl(controls []string) []reporthandling.PolicyIdentifier {
+	newPolicy := reporthandling.PolicyIdentifier{}
+	newPolicy.Kind = reporthandling.KindControl
+	newPolicy.Name = controls[0]
+	scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
+	return scanInfo.PolicyIdentifier
+}
+
+func SetScanForGivenControls(controls []string) []reporthandling.PolicyIdentifier {
+	for _, control := range controls {
+		control := strings.TrimLeft(control, " ")
+		newPolicy := reporthandling.PolicyIdentifier{}
+		newPolicy.Kind = reporthandling.KindControl
+		newPolicy.Name = control
+		scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
+	}
+	return scanInfo.PolicyIdentifier
+}
--- a/clihandler/cmd/download.go
+++ b/clihandler/cmd/download.go
@@ -6,14 +6,13 @@ import (

 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/kubescape/cautils/getter"
-	"github.com/armosec/kubescape/clihandler"
 	"github.com/spf13/cobra"
 )

 var downloadInfo cautils.DownloadInfo

 var downloadCmd = &cobra.Command{
-	Use:   fmt.Sprintf("download framework/control <framework-name>/<control-name> [flags]\nSupported frameworks: %s", clihandler.ValidFrameworks),
+	Use:   fmt.Sprintf("download framework/control <framework-name>/<control-name> [flags]\nSupported frameworks: %s", getter.NativeFrameworks),
 	Short: "Download framework/control",
 	Long:  ``,
 	Args: func(cmd *cobra.Command, args []string) error {
@@ -29,6 +28,10 @@ var downloadCmd = &cobra.Command{
 		if strings.EqualFold(args[0], "framework") {
 			downloadInfo.FrameworkName = strings.ToLower(args[1])
 			g := getter.NewDownloadReleasedPolicy()
+			if err := g.SetRegoObjects(); err != nil {
+				return err
+			}
+
 			if downloadInfo.Path == "" {
 				downloadInfo.Path = getter.GetDefaultPath(downloadInfo.FrameworkName + ".json")
 			}
@@ -43,6 +46,9 @@ var downloadCmd = &cobra.Command{
 		} else if strings.EqualFold(args[0], "control") {
 			downloadInfo.ControlName = strings.ToLower(args[1])
 			g := getter.NewDownloadReleasedPolicy()
+			if err := g.SetRegoObjects(); err != nil {
+				return err
+			}
 			if downloadInfo.Path == "" {
 				downloadInfo.Path = getter.GetDefaultPath(downloadInfo.ControlName + ".json")
 			}
--- a/clihandler/cmd/framework.go
+++ b/clihandler/cmd/framework.go
@@ -7,78 +7,110 @@ import (
 	"strings"

 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
 	"github.com/armosec/kubescape/clihandler"
 	"github.com/armosec/opa-utils/reporthandling"
-
 	"github.com/spf13/cobra"
 )

-var frameworkCmd = &cobra.Command{
+var (
+	frameworkExample = `
+  # Scan all frameworks and submit the results
+  kubescape scan --submit
+  
+  # Scan the NSA framework
+  kubescape scan framework nsa
+  
+  # Scan the NSA and MITRE framework
+  kubescape scan framework nsa,mitre
+  
+  # Scan kubernetes YAML manifest files
+  kubescape scan framework nsa *.yaml

-	Use:       fmt.Sprintf("framework <framework name> [`<glob pattern>`/`-`] [flags]\nSupported frameworks: %s", clihandler.ValidFrameworks),
-	Short:     fmt.Sprintf("The framework you wish to use. Supported frameworks: %s", strings.Join(clihandler.SupportedFrameworks, ", ")),
+  # Scan and save the results in the JSON format
+  kubescape scan --format json --output results.json
+
+  # Save scan results in JSON format
+  kubescape scan --format json --output results.json
+
+  # Display all resources
+  kubescape scan --verbose
+`
+)
+var frameworkCmd = &cobra.Command{
+	Use:       "framework <framework names list> [`<glob pattern>`/`-`] [flags]",
+	Short:     fmt.Sprintf("The framework you wish to use. Supported frameworks: %s", strings.Join(getter.NativeFrameworks, ", ")),
+	Example:   frameworkExample,
 	Long:      "Execute a scan on a running Kubernetes cluster or `yaml`/`json` files (use glob) or `-` for stdin",
-	ValidArgs: clihandler.SupportedFrameworks,
+	ValidArgs: getter.NativeFrameworks,
 	Args: func(cmd *cobra.Command, args []string) error {
-		if len(args) < 1 && !(cmd.Flags().Lookup("use-from").Changed) {
-			return fmt.Errorf("requires at least one argument")
-		} else if len(args) > 0 {
-			if !isValidFramework(strings.ToLower(args[0])) {
-				return fmt.Errorf(fmt.Sprintf("supported frameworks: %s", strings.Join(clihandler.SupportedFrameworks, ", ")))
+		if len(args) > 0 {
+			frameworks := strings.Split(args[0], ",")
+			if len(frameworks) > 1 {
+				if frameworks[1] == "" {
+					return fmt.Errorf("usage: <framework-0>,<framework-1>")
+				}
 			}
+		} else {
+			return fmt.Errorf("requires at least one framework name")
 		}
 		return nil
 	},
 	RunE: func(cmd *cobra.Command, args []string) error {
-		scanInfo.PolicyIdentifier = reporthandling.PolicyIdentifier{}
-		scanInfo.PolicyIdentifier.Kind = reporthandling.KindFramework
 		flagValidationFramework()
-		if !(cmd.Flags().Lookup("use-from").Changed) {
-			scanInfo.PolicyIdentifier.Name = strings.ToLower(args[0])
-		}
-		if len(args) > 0 {
-			if len(args[1:]) == 0 || args[1] != "-" {
-				scanInfo.InputPatterns = args[1:]
-			} else { // store stout to file
-				tempFile, err := os.CreateTemp(".", "tmp-kubescape*.yaml")
-				if err != nil {
-					return err
-				}
-				defer os.Remove(tempFile.Name())
+		var frameworks []string

-				if _, err := io.Copy(tempFile, os.Stdin); err != nil {
-					return err
+		if len(args) == 0 { // scan all frameworks
+			frameworks = getter.NativeFrameworks
+			scanInfo.ScanAll = true
+		} else {
+			// Read frameworks from input args
+			frameworks = strings.Split(args[0], ",")
+
+			if len(args) > 1 {
+				if len(args[1:]) == 0 || args[1] != "-" {
+					scanInfo.InputPatterns = args[1:]
+				} else { // store stdin to file - do NOT move to separate function !!
+					tempFile, err := os.CreateTemp(".", "tmp-kubescape*.yaml")
+					if err != nil {
+						return err
+					}
+					defer os.Remove(tempFile.Name())
+
+					if _, err := io.Copy(tempFile, os.Stdin); err != nil {
+						return err
+					}
+					scanInfo.InputPatterns = []string{tempFile.Name()}
 				}
-				scanInfo.InputPatterns = []string{tempFile.Name()}
 			}
 		}
+		scanInfo.SetPolicyIdentifiers(frameworks, reporthandling.KindFramework)
+
 		scanInfo.Init()
 		cautils.SetSilentMode(scanInfo.Silent)
-		err := clihandler.CliSetup(scanInfo)
+		err := clihandler.ScanCliSetup(&scanInfo)
 		if err != nil {
-			fmt.Fprintf(os.Stderr, "error: %v\n", err)
-			os.Exit(1)
+			return err
 		}
 		return nil
 	},
 }

-func isValidFramework(framework string) bool {
-	return cautils.StringInSlice(clihandler.SupportedFrameworks, framework) != cautils.ValueNotFound
-}
-
 func init() {
 	scanCmd.AddCommand(frameworkCmd)
 	scanInfo = cautils.ScanInfo{}
 	scanInfo.FrameworkScan = true
-	frameworkCmd.Flags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
-	frameworkCmd.Flags().BoolVarP(&scanInfo.Local, "keep-local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the '--submit' flag in the past and you do not want to submit your current scan results")
-	frameworkCmd.Flags().StringVarP(&scanInfo.Account, "account", "", "", "Armo portal account ID. Default will load account ID from configMap or config file")
-
 }

-func flagValidationFramework() {
+// func SetScanForFirstFramework(frameworks []string) []reporthandling.PolicyIdentifier {
+// 	newPolicy := reporthandling.PolicyIdentifier{}
+// 	newPolicy.Kind = reporthandling.KindFramework
+// 	newPolicy.Name = frameworks[0]
+// 	scanInfo.PolicyIdentifier = append(scanInfo.PolicyIdentifier, newPolicy)
+// 	return scanInfo.PolicyIdentifier
+// }

+func flagValidationFramework() {
 	if scanInfo.Submit && scanInfo.Local {
 		fmt.Println("You can use `keep-local` or `submit`, but not both")
 		os.Exit(1)
--- a/clihandler/cmd/rbac.go
+++ b/clihandler/cmd/rbac.go
@@ -0,0 +1,53 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/clihandler"
+	"github.com/armosec/kubescape/clihandler/cliinterfaces"
+	"github.com/armosec/kubescape/resultshandling/reporter"
+	"github.com/armosec/rbac-utils/rbacscanner"
+	"github.com/spf13/cobra"
+)
+
+// rabcCmd represents the RBAC command
+var rabcCmd = &cobra.Command{
+	Use:   "rbac \nExample:\n$ kubescape submit rbac",
+	Short: "Submit cluster's Role-Based Access Control(RBAC)",
+	Long:  ``,
+	RunE: func(cmd *cobra.Command, args []string) error {
+
+		k8s := k8sinterface.NewKubernetesApi()
+
+		// get config
+		clusterConfig, err := getSubmittedClusterConfig(k8s)
+		if err != nil {
+			return err
+		}
+
+		// list RBAC
+		rbacObjects := cautils.NewRBACObjects(rbacscanner.NewRbacScannerFromK8sAPI(k8s, clusterConfig.GetCustomerGUID(), clusterConfig.GetClusterName()))
+
+		// submit resources
+		r := reporter.NewReportEventReceiver(clusterConfig.GetConfigObj())
+
+		submitInterfaces := cliinterfaces.SubmitInterfaces{
+			ClusterConfig: clusterConfig,
+			SubmitObjects: rbacObjects,
+			Reporter:      r,
+		}
+
+		if err := clihandler.Submit(submitInterfaces); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+		return nil
+	},
+}
+
+func init() {
+	submitCmd.AddCommand(rabcCmd)
+}
--- a/clihandler/cmd/results.go
+++ b/clihandler/cmd/results.go
@@ -0,0 +1,107 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/kubescape/clihandler"
+	"github.com/armosec/kubescape/clihandler/cliinterfaces"
+	"github.com/armosec/kubescape/resultshandling/reporter"
+	"github.com/armosec/opa-utils/reporthandling"
+	uuid "github.com/satori/go.uuid"
+	"github.com/spf13/cobra"
+)
+
+type ResultsObject struct {
+	filePath     string
+	customerGUID string
+	clusterName  string
+}
+
+func NewResultsObject(customerGUID, clusterName, filePath string) *ResultsObject {
+	return &ResultsObject{
+		filePath:     filePath,
+		customerGUID: customerGUID,
+		clusterName:  clusterName,
+	}
+}
+
+func (resultsObject *ResultsObject) SetResourcesReport() (*reporthandling.PostureReport, error) {
+	// load framework results from json file
+	frameworkReports, err := loadResultsFromFile(resultsObject.filePath)
+	if err != nil {
+		return nil, err
+	}
+
+	return &reporthandling.PostureReport{
+		FrameworkReports:     frameworkReports,
+		ReportID:             uuid.NewV4().String(),
+		ReportGenerationTime: time.Now().UTC(),
+		CustomerGUID:         resultsObject.customerGUID,
+		ClusterName:          resultsObject.clusterName,
+	}, nil
+}
+
+func (resultsObject *ResultsObject) ListAllResources() (map[string]workloadinterface.IMetadata, error) {
+	return map[string]workloadinterface.IMetadata{}, nil
+}
+
+var resultsCmd = &cobra.Command{
+	Use:   "results <json file>\nExample:\n$ kubescape submit results path/to/results.json",
+	Short: "Submit a pre scanned results file. The file must be in json format",
+	Long:  ``,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if len(args) == 0 {
+			return fmt.Errorf("missing results file")
+		}
+
+		k8s := k8sinterface.NewKubernetesApi()
+
+		// get config
+		clusterConfig, err := getSubmittedClusterConfig(k8s)
+		if err != nil {
+			return err
+		}
+
+		resultsObjects := NewResultsObject(clusterConfig.GetCustomerGUID(), clusterConfig.GetClusterName(), args[0])
+
+		// submit resources
+		r := reporter.NewReportEventReceiver(clusterConfig.GetConfigObj())
+
+		submitInterfaces := cliinterfaces.SubmitInterfaces{
+			ClusterConfig: clusterConfig,
+			SubmitObjects: resultsObjects,
+			Reporter:      r,
+		}
+
+		if err := clihandler.Submit(submitInterfaces); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+		return nil
+	},
+}
+
+func init() {
+	submitCmd.AddCommand(resultsCmd)
+}
+
+func loadResultsFromFile(filePath string) ([]reporthandling.FrameworkReport, error) {
+	frameworkReports := []reporthandling.FrameworkReport{}
+	f, err := os.ReadFile(filePath)
+	if err != nil {
+		return nil, err
+	}
+	if err = json.Unmarshal(f, &frameworkReports); err != nil {
+		frameworkReport := reporthandling.FrameworkReport{}
+		if err = json.Unmarshal(f, &frameworkReport); err != nil {
+			return frameworkReports, err
+		}
+		frameworkReports = append(frameworkReports, frameworkReport)
+	}
+	return frameworkReports, nil
+}
--- a/clihandler/cmd/root.go
+++ b/clihandler/cmd/root.go
@@ -31,6 +31,7 @@ func Execute() {
 }

 func init() {
+	rootCmd.PersistentFlags().StringVarP(&scanInfo.Account, "account", "", "", "Armo portal account ID. Default will load account ID from configMap or config file")
 	flag.CommandLine.StringVar(&armoBEURLs, "environment", "", envFlagUsage)
 	rootCmd.PersistentFlags().StringVar(&armoBEURLs, "environment", "", envFlagUsage)
 	rootCmd.PersistentFlags().MarkHidden("environment")
--- a/clihandler/cmd/scan.go
+++ b/clihandler/cmd/scan.go
@@ -5,6 +5,7 @@ import (
 	"strings"

 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
 	"github.com/spf13/cobra"
 )

@@ -16,26 +17,40 @@ var scanCmd = &cobra.Command{
 	Short: "Scan the current running cluster or yaml files",
 	Long:  `The action you want to perform`,
 	Args: func(cmd *cobra.Command, args []string) error {
-		if len(args) == 0 {
-			return fmt.Errorf("requires one  argument: framework/control")
-		}
-		if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") {
-			return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0])
+		if len(args) > 0 {
+			if !strings.EqualFold(args[0], "framework") && !strings.EqualFold(args[0], "control") {
+				return fmt.Errorf("invalid parameter '%s'. Supported parameters: framework, control", args[0])
+			}
 		}
 		return nil
 	},
 	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			scanInfo.ScanAll = true
+			frameworks := getter.NativeFrameworks
+			frameworkArgs := []string{strings.Join(frameworks, ",")}
+			frameworkCmd.RunE(cmd, frameworkArgs)
+		}
 	},
 }

 func init() {
 	rootCmd.AddCommand(scanCmd)
-	scanCmd.PersistentFlags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "Namespaces to exclude from scanning. Recommended: kube-system, kube-public")
-	scanCmd.PersistentFlags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `Output format. Supported formats: "pretty-printer"/"json"/"junit"`)
+	scanCmd.PersistentFlags().StringVar(&scanInfo.ControlsInputs, "controls-config", "", "Path to an controls-config obj. If not set will download controls-config from ARMO management portal")
+	scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from ARMO management portal")
+	scanCmd.PersistentFlags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "Namespaces to exclude from scanning. Recommended: kube-system,kube-public")
+	scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent below which the command fails and returns exit code 1")
+	scanCmd.PersistentFlags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `Output format. Supported formats: "pretty-printer"/"json"/"junit"/"prometheus"`)
+	scanCmd.PersistentFlags().StringVar(&scanInfo.IncludeNamespaces, "include-namespaces", "", "scan specific namespaces. e.g: --include-namespaces ns-a,ns-b")
+	scanCmd.PersistentFlags().BoolVarP(&scanInfo.Local, "keep-local", "", false, "If you do not want your Kubescape results reported to Armo backend. Use this flag if you ran with the '--submit' flag in the past and you do not want to submit your current scan results")
 	scanCmd.PersistentFlags().StringVarP(&scanInfo.Output, "output", "o", "", "Output file. Print output to file and not stdout")
+	scanCmd.PersistentFlags().BoolVar(&scanInfo.VerboseMode, "verbose", false, "Display all of the input resources and not only failed resources")
+	scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local policy object from default path. If not used will download latest")
+	scanCmd.PersistentFlags().StringSliceVar(&scanInfo.UseFrom, "use-from", nil, "Load local policy object from specified path. If not used will download latest")
 	scanCmd.PersistentFlags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages")
-	scanCmd.PersistentFlags().Uint16VarP(&scanInfo.FailThreshold, "fail-threshold", "t", 0, "Failure threshold is the percent bellow which the command fails and returns exit code 1")
-	scanCmd.PersistentFlags().StringVar(&scanInfo.UseFrom, "use-from", "", "Load local framework object from specified path. If not used will download latest")
-	scanCmd.PersistentFlags().BoolVar(&scanInfo.UseDefault, "use-default", false, "Load local framework object from default path. If not used will download latest")
-	scanCmd.PersistentFlags().StringVar(&scanInfo.UseExceptions, "exceptions", "", "Path to an exceptions obj. If not set will download exceptions from Armo management portal")
+	scanCmd.PersistentFlags().BoolVarP(&scanInfo.Submit, "submit", "", false, "Send the scan results to Armo management portal where you can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more. By default the results are not submitted")
+
+  hostF := scanCmd.PersistentFlags().VarPF(&scanInfo.HostSensor, "enable-host-scan", "", "Deploy ARMO K8s host-sensor daemonset in the scanned cluster. Deleting it right after we collecting the data. Required to collect valueable data from cluster nodes for certain controls")
+	hostF.NoOptDefVal = "true"
+	hostF.DefValue = "false, for no TTY in stdin"
 }
--- a/clihandler/cmd/submit.go
+++ b/clihandler/cmd/submit.go
@@ -0,0 +1,31 @@
+package cmd
+
+import (
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
+	"github.com/spf13/cobra"
+)
+
+var submitCmd = &cobra.Command{
+	Use:   "submit <command>",
+	Short: "Submit an object to the Kubescape SaaS version",
+	Long:  ``,
+	Run: func(cmd *cobra.Command, args []string) {
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(submitCmd)
+}
+
+func getSubmittedClusterConfig(k8s *k8sinterface.KubernetesApi) (*cautils.ClusterConfig, error) {
+	clusterConfig := cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account) // TODO - support none cluster env submit
+	if clusterConfig.GetCustomerGUID() != "" {
+		if err := clusterConfig.SetTenant(); err != nil {
+			return clusterConfig, err
+		}
+	}
+
+	return clusterConfig, nil
+}
--- a/clihandler/cmd/version.go
+++ b/clihandler/cmd/version.go
@@ -1,49 +1,24 @@
 package cmd

 import (
-	"encoding/json"
 	"fmt"
-	"io"
-	"net/http"

+	"github.com/armosec/kubescape/cautils"
 	"github.com/spf13/cobra"
 )

-var BuildNumber string
-
 var versionCmd = &cobra.Command{
 	Use:   "version",
 	Short: "Get current version",
 	Long:  ``,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		fmt.Println("Your current version is: " + BuildNumber)
+		v := cautils.NewIVersionCheckHandler()
+		v.CheckLatestVersion(cautils.NewVersionCheckRequest(cautils.BuildNumber, "", "", "version"))
+		fmt.Println("Your current version is: " + cautils.BuildNumber)
 		return nil
 	},
 }

-func GetLatestVersion() (string, error) {
-	latestVersion := "https://api.github.com/repos/armosec/kubescape/releases/latest"
-	resp, err := http.Get(latestVersion)
-	if err != nil {
-		return "", fmt.Errorf("failed to get latest releases from '%s', reason: %s", latestVersion, err.Error())
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode < 200 || 301 < resp.StatusCode {
-		return "", fmt.Errorf("failed to download file, status code: %s", resp.Status)
-	}
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return "", fmt.Errorf("failed to read response body from '%s', reason: %s", latestVersion, err.Error())
-	}
-	var data map[string]interface{}
-	err = json.Unmarshal(body, &data)
-	if err != nil {
-		return "", fmt.Errorf("failed to unmarshal response body from '%s', reason: %s", latestVersion, err.Error())
-	}
-	return fmt.Sprintf("%v", data["tag_name"]), nil
-}
-
 func init() {
 	rootCmd.AddCommand(versionCmd)
 }
--- a/clihandler/initcli.go
+++ b/clihandler/initcli.go
@@ -2,48 +2,108 @@ package clihandler

 import (
 	"fmt"
+	"io/fs"
 	"os"
-	"strings"

 	"github.com/armosec/armoapi-go/armotypes"
 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/clihandler/cliinterfaces"
+	"github.com/armosec/kubescape/hostsensorutils"
 	"github.com/armosec/kubescape/opaprocessor"
 	"github.com/armosec/kubescape/policyhandler"
+	"github.com/armosec/kubescape/resourcehandler"
 	"github.com/armosec/kubescape/resultshandling"
 	"github.com/armosec/kubescape/resultshandling/printer"
 	"github.com/armosec/kubescape/resultshandling/reporter"
 	"github.com/armosec/opa-utils/reporthandling"
+	"github.com/mattn/go-isatty"
 )

-type CLIHandler struct {
-	policyHandler *policyhandler.PolicyHandler
-	scanInfo      *cautils.ScanInfo
+type componentInterfaces struct {
+	tenantConfig      cautils.ITenantConfig
+	resourceHandler   resourcehandler.IResourceHandler
+	report            reporter.IReport
+	printerHandler    printer.IPrinter
+	hostSensorHandler hostsensorutils.IHostSensor
 }

-var SupportedFrameworks = []string{"nsa", "mitre"}
-var ValidFrameworks = strings.Join(SupportedFrameworks, ", ")
+func getInterfaces(scanInfo *cautils.ScanInfo) componentInterfaces {

-func CliSetup(scanInfo cautils.ScanInfo) error {
+	k8s := getKubernetesApi(scanInfo)

-	clusterConfig, k8s := scanInfo.SetClusterConfig()
+	tenantConfig := getTenantConfig(scanInfo, k8s)
+
+	// Set submit behavior AFTER loading tenant config
+	setSubmitBehavior(scanInfo, tenantConfig)
+
+	hostSensorHandler := getHostSensorHandler(scanInfo, k8s)
+	if err := hostSensorHandler.Init(); err != nil {
+		errMsg := "failed to init host sensor"
+		if scanInfo.VerboseMode {
+			errMsg = fmt.Sprintf("%s: %v", errMsg, err)
+		}
+		cautils.ErrorDisplay(errMsg)
+		hostSensorHandler = &hostsensorutils.HostSensorHandlerMock{}
+	}
+	// excluding hostsensor namespace
+	if len(scanInfo.IncludeNamespaces) == 0 && hostSensorHandler.GetNamespace() != "" {
+		scanInfo.ExcludedNamespaces = fmt.Sprintf("%s,%s", scanInfo.ExcludedNamespaces, hostSensorHandler.GetNamespace())
+	}
+
+	resourceHandler := getResourceHandler(scanInfo, tenantConfig, k8s, hostSensorHandler)
+
+	// reporting behavior - setup reporter
+	reportHandler := getReporter(tenantConfig, scanInfo.Submit)
+
+	v := cautils.NewIVersionCheckHandler()
+	v.CheckLatestVersion(cautils.NewVersionCheckRequest(cautils.BuildNumber, policyIdentifierNames(scanInfo.PolicyIdentifier), "", scanInfo.GetScanningEnvironment()))
+
+	// setup printer
+	printerHandler := printer.GetPrinter(scanInfo.Format, scanInfo.VerboseMode)
+	printerHandler.SetWriter(scanInfo.Output)
+
+	return componentInterfaces{
+		tenantConfig:      tenantConfig,
+		resourceHandler:   resourceHandler,
+		report:            reportHandler,
+		printerHandler:    printerHandler,
+		hostSensorHandler: hostSensorHandler,
+	}
+}
+
+func ScanCliSetup(scanInfo *cautils.ScanInfo) error {
+	cautils.ScanStartDisplay()
+
+	interfaces := getInterfaces(scanInfo)
+	// setPolicyGetter(scanInfo, interfaces.clusterConfig.GetCustomerGUID())

 	processNotification := make(chan *cautils.OPASessionObj)
 	reportResults := make(chan *cautils.OPASessionObj)

-	// policy handler setup
-	policyHandler := policyhandler.NewPolicyHandler(&processNotification, k8s)
+	cautils.ClusterName = interfaces.tenantConfig.GetClusterName()   // TODO - Deprecated
+	cautils.CustomerGUID = interfaces.tenantConfig.GetCustomerGUID() // TODO - Deprecated
+	interfaces.report.SetClusterName(interfaces.tenantConfig.GetClusterName())
+	interfaces.report.SetCustomerGUID(interfaces.tenantConfig.GetCustomerGUID())

-	if err := clusterConfig.SetConfig(scanInfo.Account); err != nil {
-		fmt.Println(err)
-	}
+	// set policy getter only after setting the customerGUID
+	setPolicyGetter(scanInfo, interfaces.tenantConfig.GetCustomerGUID())

-	cautils.ClusterName = clusterConfig.GetClusterName()
-	cautils.CustomerGUID = clusterConfig.GetCustomerGUID()
+	defer func() {
+		if err := interfaces.hostSensorHandler.TearDown(); err != nil {
+			errMsg := "failed to tear down host sensor"
+			if scanInfo.VerboseMode {
+				errMsg = fmt.Sprintf("%s: %v", errMsg, err)
+			}
+			cautils.ErrorDisplay(errMsg)
+		}
+	}()

 	// cli handler setup
 	go func() {
-		cli := NewCLIHandler(policyHandler, scanInfo)
-		if err := cli.Scan(); err != nil {
+		// policy handler setup
+		policyHandler := policyhandler.NewPolicyHandler(&processNotification, interfaces.resourceHandler)
+
+		if err := Scan(policyHandler, scanInfo); err != nil {
 			fmt.Println(err)
 			os.Exit(1)
 		}
@@ -55,41 +115,29 @@ func CliSetup(scanInfo cautils.ScanInfo) error {
 		opaprocessorObj.ProcessRulesListenner()
 	}()

-	resultsHandling := resultshandling.NewResultsHandler(&reportResults, reporter.NewReportEventReceiver(), printer.NewPrinter(scanInfo.Format, scanInfo.Output))
+	resultsHandling := resultshandling.NewResultsHandler(&reportResults, interfaces.report, interfaces.printerHandler)
 	score := resultsHandling.HandleResults(scanInfo)

 	// print report url
-	if scanInfo.FrameworkScan {
-		clusterConfig.GenerateURL()
-	}
+	interfaces.report.DisplayReportURL()

 	adjustedFailThreshold := float32(scanInfo.FailThreshold) / 100
 	if score < adjustedFailThreshold {
-		return fmt.Errorf("Scan score is bellow threshold")
+		return fmt.Errorf("Scan score is below threshold")
 	}

 	return nil
 }

-func NewCLIHandler(policyHandler *policyhandler.PolicyHandler, scanInfo cautils.ScanInfo) *CLIHandler {
-	return &CLIHandler{
-		scanInfo:      &scanInfo,
-		policyHandler: policyHandler,
-	}
-}
-
-func (clihandler *CLIHandler) Scan() error {
-	cautils.ScanStartDisplay()
+func Scan(policyHandler *policyhandler.PolicyHandler, scanInfo *cautils.ScanInfo) error {
 	policyNotification := &reporthandling.PolicyNotification{
 		NotificationType: reporthandling.TypeExecPostureScan,
-		Rules: []reporthandling.PolicyIdentifier{
-			clihandler.scanInfo.PolicyIdentifier,
-		},
-		Designators: armotypes.PortalDesignator{},
+		Rules:            scanInfo.PolicyIdentifier,
+		Designators:      armotypes.PortalDesignator{},
 	}
 	switch policyNotification.NotificationType {
 	case reporthandling.TypeExecPostureScan:
-		if err := clihandler.policyHandler.HandleNotificationRequest(policyNotification, clihandler.scanInfo); err != nil {
+		if err := policyHandler.HandleNotificationRequest(policyNotification, scanInfo); err != nil {
 			return err
 		}

@@ -98,3 +146,46 @@ func (clihandler *CLIHandler) Scan() error {
 	}
 	return nil
 }
+
+func Submit(submitInterfaces cliinterfaces.SubmitInterfaces) error {
+
+	// list resources
+	postureReport, err := submitInterfaces.SubmitObjects.SetResourcesReport()
+	if err != nil {
+		return err
+	}
+	allresources, err := submitInterfaces.SubmitObjects.ListAllResources()
+	if err != nil {
+		return err
+	}
+	// report
+	if err := submitInterfaces.Reporter.ActionSendReport(&cautils.OPASessionObj{PostureReport: postureReport, AllResources: allresources}); err != nil {
+		return err
+	}
+	fmt.Printf("\nData has been submitted successfully")
+	submitInterfaces.Reporter.DisplayReportURL()
+
+	return nil
+}
+
+func askUserForHostSensor() bool {
+	return false
+
+	if !isatty.IsTerminal(os.Stdin.Fd()) {
+		return false
+	}
+	if ssss, err := os.Stdin.Stat(); err == nil {
+		// fmt.Printf("Found stdin type: %s\n", ssss.Mode().Type())
+		if ssss.Mode().Type()&(fs.ModeDevice|fs.ModeCharDevice) > 0 { //has TTY
+			fmt.Printf("Would you like to scan K8s nodes? [y/N]. This is required to collect valuable data for certain controls\n")
+			fmt.Printf("Use --enable-host-scan flag to suppress this message\n")
+			var b []byte = make([]byte, 1)
+			if n, err := os.Stdin.Read(b); err == nil {
+				if n > 0 && len(b) > 0 && (b[0] == 'y' || b[0] == 'Y') {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
--- a/clihandler/initcliutils.go
+++ b/clihandler/initcliutils.go
@@ -0,0 +1,180 @@
+package clihandler
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
+	"github.com/armosec/kubescape/hostsensorutils"
+	"github.com/armosec/kubescape/resourcehandler"
+	"github.com/armosec/kubescape/resultshandling/reporter"
+	"github.com/armosec/opa-utils/reporthandling"
+	"github.com/armosec/rbac-utils/rbacscanner"
+	"github.com/golang/glog"
+)
+
+func getKubernetesApi(scanInfo *cautils.ScanInfo) *k8sinterface.KubernetesApi {
+	if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles {
+		return nil
+	}
+	return k8sinterface.NewKubernetesApi()
+}
+func getTenantConfig(scanInfo *cautils.ScanInfo, k8s *k8sinterface.KubernetesApi) cautils.ITenantConfig {
+	if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles {
+		return cautils.NewLocalConfig(getter.GetArmoAPIConnector(), scanInfo.Account)
+	}
+	return cautils.NewClusterConfig(k8s, getter.GetArmoAPIConnector(), scanInfo.Account)
+}
+
+func getRBACHandler(tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, submit bool) *cautils.RBACObjects {
+	if submit {
+		return cautils.NewRBACObjects(rbacscanner.NewRbacScannerFromK8sAPI(k8s, tenantConfig.GetCustomerGUID(), tenantConfig.GetClusterName()))
+	}
+	return nil
+}
+
+func getReporter(tenantConfig cautils.ITenantConfig, submit bool) reporter.IReport {
+	if submit {
+		return reporter.NewReportEventReceiver(tenantConfig.GetConfigObj())
+
+	}
+	return reporter.NewReportMock()
+}
+func getResourceHandler(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantConfig, k8s *k8sinterface.KubernetesApi, hostSensorHandler hostsensorutils.IHostSensor) resourcehandler.IResourceHandler {
+	if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles {
+		return resourcehandler.NewFileResourceHandler(scanInfo.InputPatterns)
+	}
+	rbacObjects := getRBACHandler(tenantConfig, k8s, scanInfo.Submit)
+	return resourcehandler.NewK8sResourceHandler(k8s, getFieldSelector(scanInfo), hostSensorHandler, rbacObjects)
+}
+
+func getHostSensorHandler(scanInfo *cautils.ScanInfo, k8s *k8sinterface.KubernetesApi) hostsensorutils.IHostSensor {
+	if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles {
+		return &hostsensorutils.HostSensorHandlerMock{}
+	}
+	hasHostSensorControls := true
+	// we need to determined which controls needs host sensor
+	if scanInfo.HostSensor.Get() == nil && hasHostSensorControls {
+		scanInfo.HostSensor.SetBool(askUserForHostSensor())
+	}
+	if hostSensorVal := scanInfo.HostSensor.Get(); hostSensorVal != nil && *hostSensorVal {
+		hostSensorHandler, err := hostsensorutils.NewHostSensorHandler(k8s)
+		if err != nil || hostSensorHandler == nil {
+			glog.Errorf("failed to create host sensor: %v", err)
+			return &hostsensorutils.HostSensorHandlerMock{}
+		}
+		return hostSensorHandler
+	}
+	return &hostsensorutils.HostSensorHandlerMock{}
+}
+func getFieldSelector(scanInfo *cautils.ScanInfo) resourcehandler.IFieldSelector {
+	if scanInfo.IncludeNamespaces != "" {
+		return resourcehandler.NewIncludeSelector(scanInfo.IncludeNamespaces)
+	}
+	if scanInfo.ExcludedNamespaces != "" {
+		return resourcehandler.NewExcludeSelector(scanInfo.ExcludedNamespaces)
+	}
+
+	return &resourcehandler.EmptySelector{}
+}
+
+func policyIdentifierNames(pi []reporthandling.PolicyIdentifier) string {
+	policiesNames := ""
+	for i := range pi {
+		policiesNames += pi[i].Name
+		if i+1 < len(pi) {
+			policiesNames += ","
+		}
+	}
+	if policiesNames == "" {
+		policiesNames = "all"
+	}
+	return policiesNames
+}
+
+// setSubmitBehavior - Setup the desired cluster behavior regarding submittion to the Armo BE
+func setSubmitBehavior(scanInfo *cautils.ScanInfo, tenantConfig cautils.ITenantConfig) {
+
+	/*
+
+		If "First run (local config not found)" -
+			Default/keep-local - Do not send report
+			Submit - Create tenant & Submit report
+
+		If "Submitted" -
+			keep-local - Do not send report
+			Default/Submit - Submit report
+
+	*/
+
+	// do not submit control scanning
+	if !scanInfo.FrameworkScan {
+		scanInfo.Submit = false
+		return
+	}
+
+	// do not submit yaml/url scanning
+	if scanInfo.GetScanningEnvironment() == cautils.ScanLocalFiles {
+		scanInfo.Submit = false
+		return
+	}
+
+	if tenantConfig.IsConfigFound() { // config found in cache (submitted)
+		if !scanInfo.Local {
+			// Submit report
+			scanInfo.Submit = true
+		}
+	} else { // config not found in cache (not submitted)
+		if scanInfo.Submit {
+			// submit - Create tenant & Submit report
+			if err := tenantConfig.SetTenant(); err != nil {
+				fmt.Println(err)
+			}
+		}
+	}
+}
+
+// setPolicyGetter set the policy getter - local file/github release/ArmoAPI
+func setPolicyGetter(scanInfo *cautils.ScanInfo, customerGUID string) {
+	if len(scanInfo.UseFrom) > 0 {
+		scanInfo.PolicyGetter = getter.NewLoadPolicy(scanInfo.UseFrom)
+	} else {
+		if customerGUID == "" || !scanInfo.FrameworkScan {
+			setDownloadReleasedPolicy(scanInfo)
+		} else {
+			setGetArmoAPIConnector(scanInfo, customerGUID)
+		}
+	}
+}
+
+func setDownloadReleasedPolicy(scanInfo *cautils.ScanInfo) {
+	g := getter.NewDownloadReleasedPolicy()    // download policy from github release
+	if err := g.SetRegoObjects(); err != nil { // if failed to pull policy, fallback to cache
+		cautils.WarningDisplay(os.Stdout, "Warning: failed to get policies from github release, loading policies from cache\n")
+		scanInfo.PolicyGetter = getter.NewLoadPolicy(getDefaultFrameworksPaths())
+	} else {
+		scanInfo.PolicyGetter = g
+	}
+}
+func setGetArmoAPIConnector(scanInfo *cautils.ScanInfo, customerGUID string) {
+	g := getter.GetArmoAPIConnector() // download policy from ARMO backend
+	g.SetCustomerGUID(customerGUID)
+	scanInfo.PolicyGetter = g
+	if scanInfo.ScanAll {
+		frameworks, err := g.ListCustomFrameworks(customerGUID)
+		if err != nil {
+			glog.Error("failed to get custom frameworks") // handle error
+			return
+		}
+		scanInfo.SetPolicyIdentifiers(frameworks, reporthandling.KindFramework)
+	}
+}
+func getDefaultFrameworksPaths() []string {
+	fwPaths := []string{}
+	for i := range getter.NativeFrameworks {
+		fwPaths = append(fwPaths, getter.GetDefaultPath(getter.NativeFrameworks[i]))
+	}
+	return fwPaths
+}
--- a/docs/run-options.md
+++ b/docs/run-options.md
@@ -13,7 +13,7 @@ kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
 | --- | --- | --- | --- |
 | `-e`/`--exclude-namespaces` | Scan all namespaces | Namespaces to exclude from scanning. Recommended to exclude `kube-system` and `kube-public` namespaces |
 | `-s`/`--silent` | Display progress messages | Silent progress messages |
-| `-t`/`--fail-threshold` | `0` (do not fail) | fail command (return exit code 1) if result bellow threshold| `0` -> `100` |
+| `-t`/`--fail-threshold` | `0` (do not fail) | fail command (return exit code 1) if result is below threshold| `0` -> `100` |
 | `-f`/`--format` | `pretty-printer` | Output format | `pretty-printer`/`json`/`junit` | 
 | `-o`/`--output` | print to stdout | Save scan result in file |
 | `--use-from` | | Load local framework object from specified path. If not used will download latest |
@@ -25,7 +25,7 @@ kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
 
 ### Examples

-* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework
+* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework
 ```
 kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
 ```
@@ -85,5 +85,3 @@ kubescape scan framework nsa --use-from nsa.json
 ```

 Kubescape is an open source project, we welcome your feedback and ideas for improvement. We’re also aiming to collaborate with the Kubernetes community to help make the tests themselves more robust and complete as Kubernetes develops.
-
-
--- a/docs/summary.png
+++ b/docs/summary.png
--- a/examples/cronJob-support/README.md
+++ b/examples/cronJob-support/README.md
@@ -0,0 +1,85 @@
+# Periodically Kubescape Scanning
+
+You can scan your cluster periodically by adding a `CronJob` that will repeatedly trigger kubescape
+
+* Setup [scanning & submitting](#scanning-and-submitting)
+* Setup [scanning without submitting](#scanning-without-submitting)
+
+## Scanning And Submitting
+
+If you wish to periodically scan and submit the result to the [Kubescape SaaS version](https://portal.armo.cloud/) where you can benefit the features the SaaS version provides, please follow this instructions ->
+
+1. Apply kubescape namespace
+    ```
+    kubectl apply ks-namespace.yaml
+    ```
+
+2. Apply serviceAccount and roles
+    ```
+    kubectl apply ks-serviceAccount.yaml
+    ```
+
+3. Setup and apply configMap
+   
+    Before you apply the configMap you need to set the account ID and cluster name in the `ks-configMap.yaml` file.
+
+    * Set cluster name:
+        Run `kubectl config current-context` and set the result in the `data.clusterName` field
+    * Set account ID:
+        1. Navigate to the [Kubescape SaaS version](https://portal.armo.cloud/) and login/sign up for free 
+        2. Click the `Add Cluster` button on the top right of the page 
+            </br>
+            <img src="screenshots/add-cluster.png"  alt="add-cluster">
+        3. Copy the value of `--account` and set it in the `data.customerGUID` field
+            </br>
+            <img src="screenshots/account.png"  alt="account">
+
+        Make sure the configMap looks as following;
+        ```
+        kind: ConfigMap 
+        apiVersion: v1 
+        metadata:
+        name: kubescape 
+        labels:
+            app: kubescape
+        namespace: kubescape
+        data:
+        config.json: |
+            {
+                "customerGUID": "XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX",
+                "clusterName": "my-awesome-cluster-name"
+            }
+        ```
+
+    Finally, apply the configMap
+    ```
+    kubectl apply ks-configMap.yaml
+    ```
+
+4. Apply CronJob
+
+    Before you apply the cronJob, make sure the scanning frequency suites your needs
+    ```
+    kubectl apply ks-cronJob-submit.yaml
+    ```
+
+## Scanning Without Submitting
+
+If you wish to periodically scan but not submit the scan results, follow this instructions ->
+
+1. Apply kubescape namespace
+    ```
+    kubectl apply ks-namespace.yaml
+    ```
+
+2. Apply serviceAccount and roles
+    ```
+    kubectl apply ks-serviceAccount.yaml
+    ```
+
+3. Apply CronJob
+
+    Before you apply the cronJob, make sure the scanning frequency suites your needs
+    ```
+    kubectl apply ks-cronJob-non-submit.yaml
+    ```
--- a/examples/cronJob-support/ks-configMap.yaml
+++ b/examples/cronJob-support/ks-configMap.yaml
@@ -0,0 +1,14 @@
+# ------------------- Kubescape User/Customer ID ------------------- #
+kind: ConfigMap 
+apiVersion: v1 
+metadata:
+  name: kubescape 
+  labels:
+    app: kubescape
+  namespace: kubescape
+data:
+  config.json: |
+    {
+      "customerGUID": "<ID>",
+      "clusterName": "<cluster name>"
+    }
--- a/examples/cronJob-support/ks-cronJob-non-submit.yaml
+++ b/examples/cronJob-support/ks-cronJob-non-submit.yaml
@@ -0,0 +1,32 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kubescape
+  labels:
+    app: kubescape
+  namespace: kubescape
+spec:
+  #      ┌────────────────── timezone (optional)
+  #      |      ┌───────────── minute (0 - 59)
+  #      |      │ ┌───────────── hour (0 - 23)
+  #      |      │ │ ┌───────────── day of the month (1 - 31)
+  #      |      │ │ │ ┌───────────── month (1 - 12)
+  #      |      │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
+  #      |      │ │ │ │ │                         7 is also Sunday on some systems)
+  #      |      │ │ │ │ │
+  #      |      │ │ │ │ │
+  # CRON_TZ=UTC * * * * *
+  schedule: "0 0 1 * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: kubescape
+            image: quay.io/armosec/kubescape:latest
+            imagePullPolicy: IfNotPresent
+            command: ["/bin/sh","-c"]
+            args: 
+            - kubescape scan framework nsa
+          restartPolicy: OnFailure
+          serviceAccountName: kubescape-discovery
--- a/examples/cronJob-support/ks-cronJob-submit.yaml
+++ b/examples/cronJob-support/ks-cronJob-submit.yaml
@@ -0,0 +1,40 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kubescape
+  labels:
+    app: kubescape
+  namespace: kubescape
+spec:
+  #      ┌────────────────── timezone (optional)
+  #      |      ┌───────────── minute (0 - 59)
+  #      |      │ ┌───────────── hour (0 - 23)
+  #      |      │ │ ┌───────────── day of the month (1 - 31)
+  #      |      │ │ │ ┌───────────── month (1 - 12)
+  #      |      │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
+  #      |      │ │ │ │ │                         7 is also Sunday on some systems)
+  #      |      │ │ │ │ │
+  #      |      │ │ │ │ │
+  # CRON_TZ=UTC * * * * *
+  schedule: "0 0 1 * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: kubescape
+            image: quay.io/armosec/kubescape:latest
+            imagePullPolicy: IfNotPresent
+            command: ["/bin/sh","-c"]
+            args: 
+            - kubescape scan framework nsa --submit
+            volumeMounts:
+            - name: kubescape-config-volume
+              mountPath: /root/.kubescape/config.json
+              subPath: config.json
+          restartPolicy: OnFailure
+          serviceAccountName: kubescape-discovery
+          volumes:
+          - name: kubescape-config-volume
+            configMap:
+              name: kubescape
--- a/examples/cronJob-support/ks-namespace.yaml
+++ b/examples/cronJob-support/ks-namespace.yaml
@@ -0,0 +1,7 @@
+# ------------------- Kubescape User/Customer ID ------------------- #
+kind: Namespace 
+apiVersion: v1 
+metadata:
+  name: kubescape
+  labels:
+    app: kubescape
--- a/examples/cronJob-support/ks-serviceAccount.yaml
+++ b/examples/cronJob-support/ks-serviceAccount.yaml
@@ -0,0 +1,61 @@
+---
+# ------------------- Kubescape Service Account ------------------- #
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: kubescape
+  name: kubescape-discovery
+  namespace: kubescape
+
+---
+# ------------------- Kubescape Role & Role Binding ------------------- #
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubescape-discovery-role
+  namespace: kubescape
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["get", "list", "describe"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubescape-discovery-binding
+  namespace: kubescape
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubescape-discovery-role
+subjects:
+- kind: ServiceAccount
+  name: kubescape-discovery
+
+---
+# ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- #
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubescape-discovery-clusterroles
+  # "namespace" omitted since ClusterRoles are not namespaced
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["get", "list", "describe"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubescape-discovery-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubescape-discovery-clusterroles
+subjects:
+- kind: ServiceAccount
+  name: kubescape-discovery
+  namespace: kubescape
--- a/examples/cronJob-support/screenshots/account.png
+++ b/examples/cronJob-support/screenshots/account.png
--- a/examples/cronJob-support/screenshots/add-cluster.png
+++ b/examples/cronJob-support/screenshots/add-cluster.png
--- a/examples/cronjob/ks-cronjob.yaml
+++ b/examples/cronjob/ks-cronjob.yaml
@@ -1,3 +1,10 @@
+# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+# 
+# This file is DEPRECATE, please navigate to the official docs ->
+# https://github.com/armosec/kubescape/tree/master/examples/cronJob-support/README.md
+#
+# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
 ---
 # ------------------- Kubescape Service Account ------------------- #
 apiVersion: v1
@@ -72,10 +79,8 @@ metadata:
 data:
  config.json: |
    {
-      "adminMail": "",
-      "customerGUID": "<MyGUID>",
-      "clusterName": "<MyK8sClusterName>",
-      "invitationParam": ""
+      "customerGUID": <MyGUID>,
+      "clusterName": <MyK8sClusterName>
    }

 ---
@@ -104,12 +109,11 @@ spec:
        spec:
          containers:
          - name: kubescape
-            image: quay.io/armosec/kubescape:latset
+            image: quay.io/armosec/kubescape:latest
            imagePullPolicy: IfNotPresent
            command: ["/bin/sh","-c"]
            args: 
-            - kubescape scan framework nsa --exclude-namespaces kube-system,kube-public
-            #- kubescape scan framework nsa --use-default --exclude-namespaces kube-system,kube-public
+            - kubescape scan framework nsa --submit
            volumeMounts:
            - name: kubescape-config-volume
              mountPath: /root/.kubescape/config.json
--- a/examples/exceptions/README.md
+++ b/examples/exceptions/README.md
@@ -0,0 +1,179 @@
+# Kubescape Exceptions
+
+Kubescape Exceptions is the proper way of excluding failed resources from effecting the risk score.
+
+e.g. When a `kube-system` resource fails and it is ok, simply add the resource to the exceptions configurations.
+
+## Definitions
+
+
+* `name`- Exception name - unique name representing the exception
+* `policyType`- Do not change
+* `actions`- List of available actions. Currently alertOnly is supported
+* `resources`- List of resources to apply this exception on
+    * `designatorType: Attributes`- An attribute-based declaration {key: value}
+    Supported keys:
+    * `name`: k8s resource name (case-sensitive, regex supported)
+    * `kind`: k8s resource kind (case-sensitive, regex supported)
+    * `namespace`: k8s resource namespace (case-sensitive, regex supported)
+    * `cluster`: k8s cluster name (usually it is the `current-context`) (case-sensitive, regex supported)
+    * resource labels as key value (case-sensitive, regex NOT supported)
+* `posturePolicies`- An attribute-based declaration {key: value}
+    * `frameworkName` - Framework names can be find [here](https://github.com/armosec/regolibrary/tree/master/frameworks)
+    * `controlName` - Control names can be find [here](https://github.com/armosec/regolibrary/tree/master/controls) 
+    * `controlID` - Not yet supported
+    * `ruleName` - Rule names can be find [here](https://github.com/armosec/regolibrary/tree/master/rules) 
+ 
+
+## Usage
+
+The `resources` list and `posturePolicies` list are design to be a combination of the resources and policies to exclude
+> You must declare at least one resource and one policy
+
+e.g. If you wish to exclude all namespaces with the label `"environment": "dev"`, the resource list should look as following:
+```
+"resources": [
+    {
+        "designatorType": "Attributes",
+        "attributes": {
+            "namespace": ".*",
+            "environment": "dev"
+        }
+    }
+]
+```
+
+But if you wish to exclude all namespaces **OR** any resource with the label `"environment": "dev"`, the resource list should look as following:
+```
+"resources": [
+    {
+        "designatorType": "Attributes",
+        "attributes": {
+            "namespace": ".*"
+        }
+    },
+    {
+        "designatorType": "Attributes",
+        "attributes": {
+            "environment": "dev"
+        }
+    }
+]
+```
+
+Same works with the `posturePolicies` list ->
+
+e.g. If you wish to exclude the resources declared in the `resources` list that failed when scanning the `NSA` framework **AND** failed the `Allowed hostPath` control, the `posturePolicies` list should look as following:
+```
+"posturePolicies": [
+    {
+        "frameworkName": "NSA",
+        "controlName": "Allowed hostPath" 
+    }
+]
+```
+
+But if you wish to exclude the resources declared in the `resources` list that failed when scanning the `NSA` framework **OR** failed the `Allowed hostPath` control, the `posturePolicies` list should look as following:
+```
+"posturePolicies": [
+    {
+        "frameworkName": "NSA" 
+    },
+    {
+        "controlName": "Allowed hostPath" 
+    }
+]
+```
+
+## Examples
+
+Here are some examples demonstrating the different ways the exceptions file can be configured
+
+
+### Exclude  control
+
+Exclude the ["Allowed hostPath" control](https://github.com/armosec/regolibrary/blob/master/controls/allowedhostpath.json#L2) by declaring the control in the `"posturePolicies"` section.
+
+The resources
+
+```
+[
+    {
+        "name": "exclude-allowed-hostPath-control",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": ".*"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {
+                "controlName": "Allowed hostPath" 
+            }
+        ]
+    }
+]
+```
+
+### Exclude deployments in the default namespace that failed the "Allowed hostPath" control 
+```
+[
+    {
+        "name": "exclude-deployments-in-ns-default",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "namespace": "default",
+                    "kind": "Deployment"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {
+                "controlName": "Allowed hostPath" 
+            }
+        ]
+    }
+]
+```
+
+### Exclude resources with label "app=nginx" running in a minikube cluster that failed the "NSA" or "MITRE" framework 
+```
+[
+    {
+        "name": "exclude-nginx-minikube",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "cluster": "minikube",
+                    "app": "nginx"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {
+                "frameworkName": "NSA" 
+            },
+            {
+                "frameworkName": "MITRE" 
+            }
+        ]
+    }
+]
+```
--- a/examples/exceptions/exclude-allowed-hostPath-control.json
+++ b/examples/exceptions/exclude-allowed-hostPath-control.json
@@ -0,0 +1,22 @@
+[
+    {
+        "name": "exclude-allowed-hostPath-control",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "kind": ".*"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {
+                "controlName": "Allowed hostPath" 
+            }
+        ]
+    }
+]
--- a/examples/exceptions/exclude-deployments-in-ns-default.json
+++ b/examples/exceptions/exclude-deployments-in-ns-default.json
@@ -0,0 +1,23 @@
+[
+    {
+        "name": "exclude-deployments-in-ns-default",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "namespace": "default",
+                    "kind": "Deployment"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {
+                "controlName": "Allowed hostPath" 
+            }
+        ]
+    }
+]
--- a/examples/exceptions/exclude-kube-namespaces.json
+++ b/examples/exceptions/exclude-kube-namespaces.json
@@ -28,6 +28,12 @@
        "posturePolicies": [
            {
                "frameworkName": "NSA"
+            },
+            {
+                "frameworkName": "MITRE"
+            },
+            {
+                "frameworkName": "ArmoBest"
            }
        ]
    }
--- a/examples/exceptions/exclude-nginx-in-minikube.json
+++ b/examples/exceptions/exclude-nginx-in-minikube.json
@@ -0,0 +1,26 @@
+[
+    {
+        "name": "exclude-nginx-in-minikube",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+            "alertOnly"
+        ],
+        "resources": [
+            {
+                "designatorType": "Attributes",
+                "attributes": {
+                    "cluster": "minikube",
+                    "app": "nginx"
+                }
+            }
+        ],
+        "posturePolicies": [
+            {
+                "frameworkName": "NSA" 
+            },
+            {
+                "frameworkName": "MITRE" 
+            }
+        ]
+    }
+]
--- a/examples/helm_chart/Chart.yaml
+++ b/examples/helm_chart/Chart.yaml
@@ -0,0 +1,29 @@
+apiVersion: v2
+name: kubescape
+description:
+  Kubescape is the first open-source tool for testing if Kubernetes is deployed securely according to multiple frameworks
+  regulatory, customized company policies and DevSecOps best practices, such as the  [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) and the [MITRE ATT&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) .
+  Kubescape scans K8s clusters, YAML files, and HELM charts, and detect misconfigurations and software vulnerabilities at early stages of the CI/CD pipeline and provides a risk score instantly and risk trends over time.
+  Kubescape integrates natively with other DevOps tools, including Jenkins, CircleCI and Github workflows.
+
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 1.0.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "v1.0.128"
--- a/examples/helm_chart/README.md
+++ b/examples/helm_chart/README.md
@@ -0,0 +1,27 @@
+# kubescape
+
+![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.128](https://img.shields.io/badge/AppVersion-v1.0.128-informational?style=flat-square)
+
+Kubescape is the first open-source tool for testing if Kubernetes is deployed securely according to multiple frameworks regulatory, customized company policies and DevSecOps best practices, such as the  [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) and the [MITRE ATT&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) . Kubescape scans K8s clusters, YAML files, and HELM charts, and detect misconfigurations and software vulnerabilities at early stages of the CI/CD pipeline and provides a risk score instantly and risk trends over time. Kubescape integrates natively with other DevOps tools, including Jenkins, CircleCI and Github workflows.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` |  |
+| configMap | object | `{"create":true,"params":{"clusterName":"<MyK8sClusterName>","customerGUID":"<MyGUID>,"}}` | ARMO customer information |
+| fullnameOverride | string | `""` |  |
+| image | object | `{"imageName":"kubescape","pullPolicy":"IfNotPresent","repository":"quay.io/armosec","tag":"latest"}` | Image and version to deploy |
+| imagePullSecrets | list | `[]` |  |
+| nameOverride | string | `""` |  |
+| nodeSelector | object | `{}` |  |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext | object | `{}` |  |
+| resources | object | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"200m","memory":"256Mi"}}` | Default resources for running the service in cluster |
+| schedule | string | `"0 0 * * *"` | Frequency of running the scan |
+| securityContext | object | `{}` |  |
+| serviceAccount | object | `{"annotations":{},"create":true,"name":"kubescape-discovery"}` | Service account that runs the scan and has permissions to view the cluster |
+| tolerations | list | `[]` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
--- a/examples/helm_chart/templates/_helpers.tpl
+++ b/examples/helm_chart/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kubescape.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "kubescape.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "kubescape.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "kubescape.labels" -}}
+helm.sh/chart: {{ include "kubescape.chart" . }}
+{{ include "kubescape.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "kubescape.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "kubescape.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kubescape.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "kubescape.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
--- a/examples/helm_chart/templates/clusterrole.yaml
+++ b/examples/helm_chart/templates/clusterrole.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "kubescape.fullname" . }}
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["get", "list", "describe"]
+
--- a/examples/helm_chart/templates/clusterrolebinding.yaml
+++ b/examples/helm_chart/templates/clusterrolebinding.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "kubescape.fullname" . }}
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "kubescape.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "kubescape.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace | quote }}
+
+
--- a/examples/helm_chart/templates/configmap.yaml
+++ b/examples/helm_chart/templates/configmap.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.configMap.create -}}
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{ include "kubescape.fullname" . }}-configmap
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+data:
+  config.json: |
+    {
+      "customerGUID": "{{ .Values.configMap.params.customerGUID }}",
+      "clusterName": "{{ .Values.configMap.params.clusterName }}"
+    }
+{{- end }}
--- a/examples/helm_chart/templates/cronjob.yaml
+++ b/examples/helm_chart/templates/cronjob.yaml
@@ -0,0 +1,28 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "kubescape.fullname" . }}
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+spec:
+  schedule: "{{ .Values.schedule }}"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: {{ .Chart.Name }}
+            image: "{{ .Values.image.repository }}/{{ .Values.image.imageName }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+            imagePullPolicy: {{ .Values.image.pullPolicy }}
+            command: ["/bin/sh", "-c"]
+            args: ["kubescape scan framework nsa --submit"]
+            volumeMounts:
+            - name: kubescape-config-volume
+              mountPath: /root/.kubescape/config.json
+              subPath: config.json
+          restartPolicy: OnFailure
+          serviceAccountName: {{ include "kubescape.serviceAccountName" . }}
+          volumes:
+          - name: kubescape-config-volume
+            configMap:
+              name: {{ include "kubescape.fullname" . }}-configmap
--- a/examples/helm_chart/templates/role.yaml
+++ b/examples/helm_chart/templates/role.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "kubescape.fullname" . }}
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["get", "list", "describe"]
+
--- a/examples/helm_chart/templates/rolebinding.yaml
+++ b/examples/helm_chart/templates/rolebinding.yaml
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "kubescape.fullname" . }}
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "kubescape.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "kubescape.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace | quote }}
+
+
--- a/examples/helm_chart/templates/serviceaccount.yaml
+++ b/examples/helm_chart/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "kubescape.serviceAccountName" . }}
+  labels:
+    {{- include "kubescape.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/examples/helm_chart/values.yaml
+++ b/examples/helm_chart/values.yaml
@@ -0,0 +1,74 @@
+# Default values for kubescape.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# -- Frequency of running the scan
+#       ┌────────────── timezone (optional)
+#       |  ┌───────────── minute (0 - 59)
+#       |  │ ┌───────────── hour (0 - 23)
+#       |  │ │ ┌───────────── day of the month (1 - 31)
+#       |  │ │ │ ┌───────────── month (1 - 12)
+#       |  │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday;
+#       |  │ │ │ │ │                         7 is also Sunday on some systems)
+#       |  │ │ │ │ │
+#       |  │ │ │ │ │
+#      UTC * * * * *
+schedule: "* * 1 * *"
+
+# -- Image and version to deploy
+image:
+  repository: quay.io/armosec
+  imageName: kubescape
+  pullPolicy: Always
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: latest
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# -- Service account that runs the scan and has permissions to view the cluster
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: "kubescape-discovery"
+
+# -- ARMO customer information
+configMap:
+  create: false
+  params:
+    customerGUID: <MyGUID>
+    clusterName: <MyK8sClusterName>
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+# -- Default resources for running the service in cluster
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 200m
+    memory: 256Mi
+
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
--- a/examples/output_mocks/prometheus-verbose-flag.txt
+++ b/examples/output_mocks/prometheus-verbose-flag.txt
--- a/examples/output_mocks/prometheus.txt
+++ b/examples/output_mocks/prometheus.txt
--- a/go.mod
+++ b/go.mod
@@ -3,11 +3,12 @@ module github.com/armosec/kubescape
 go 1.17

 require (
-	github.com/armosec/armoapi-go v0.0.8
-	github.com/armosec/k8s-interface v0.0.5
-	github.com/armosec/opa-utils v0.0.13
+	github.com/armosec/armoapi-go v0.0.23
+	github.com/armosec/k8s-interface v0.0.50
+	github.com/armosec/opa-utils v0.0.75
+	github.com/armosec/rbac-utils v0.0.9
 	github.com/armosec/utils-go v0.0.3
-	github.com/briandowns/spinner v1.16.0
+	github.com/briandowns/spinner v1.18.0
 	github.com/enescakir/emoji v1.0.0
 	github.com/fatih/color v1.13.0
 	github.com/gofrs/uuid v4.1.0+incompatible
@@ -17,10 +18,12 @@ require (
 	github.com/open-policy-agent/opa v0.33.1
 	github.com/satori/go.uuid v1.2.0
 	github.com/spf13/cobra v1.2.1
+	github.com/stretchr/testify v1.7.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.22.2
 	k8s.io/apimachinery v0.22.2
 	k8s.io/client-go v0.22.2
+	sigs.k8s.io/yaml v1.2.0
 )

 require (
@@ -33,6 +36,7 @@ require (
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
 	github.com/armosec/utils-k8s-go v0.0.1 // indirect
+	github.com/aws/aws-sdk-go v1.41.11 // indirect
 	github.com/coreos/go-oidc v2.2.1+incompatible // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/docker v20.10.9+incompatible // indirect
@@ -45,30 +49,35 @@ require (
 	github.com/go-logr/logr v0.4.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/go-cmp v0.5.5 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.0.5 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.11 // indirect
 	github.com/mattn/go-colorable v0.1.9 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.1 // indirect
+	github.com/opencontainers/image-spec v1.0.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/pquerna/cachecontrol v0.1.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b // indirect
+	go.opencensus.io v0.23.0 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.19.1 // indirect
-	golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 // indirect
+	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 // indirect
 	golang.org/x/net v0.0.0-20210825183410-e898025ed96a // indirect
 	golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1 // indirect
 	golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf // indirect
@@ -76,7 +85,10 @@ require (
 	golang.org/x/text v0.3.6 // indirect
 	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
 	gonum.org/v1/gonum v0.9.1 // indirect
+	google.golang.org/api v0.44.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c // indirect
+	google.golang.org/grpc v1.38.0 // indirect
 	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
@@ -85,5 +97,4 @@ require (
 	k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a // indirect
 	sigs.k8s.io/controller-runtime v0.10.2 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect
-	sigs.k8s.io/yaml v1.2.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -84,13 +84,18 @@ github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armosec/armoapi-go v0.0.2/go.mod h1:vIK17yoKbJRQyZXWWLe3AqfqCRITxW8qmSkApyq5xFs=
-github.com/armosec/armoapi-go v0.0.7/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
-github.com/armosec/armoapi-go v0.0.8 h1:JPa9rZynuE2RucamDh6dsy/sjCScmWDsyt1zagJFCDo=
-github.com/armosec/armoapi-go v0.0.8/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
-github.com/armosec/k8s-interface v0.0.5 h1:DWQXZNMSsYQeLQ6xpB21ueFMR9oFnz28iWQTNn31TAk=
-github.com/armosec/k8s-interface v0.0.5/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
-github.com/armosec/opa-utils v0.0.13 h1:QkmmYX0lzC7ZNGetyD8ysRKQHgJhjMfvRUW2cp+hz2o=
-github.com/armosec/opa-utils v0.0.13/go.mod h1:E0mFTVx+4BYAVvO2hxWnIniv/IZIogRCak8BkKd7KK4=
+github.com/armosec/armoapi-go v0.0.23 h1:jqoLIWM5CR7DCD9fpFgN0ePqtHvOCoZv/XzCwsUluJU=
+github.com/armosec/armoapi-go v0.0.23/go.mod h1:iaVVGyc23QGGzAdv4n+szGQg3Rbpixn9yQTU3qWRpaw=
+github.com/armosec/k8s-interface v0.0.8/go.mod h1:xxS+V5QT3gVQTwZyAMMDrYLWGrfKOpiJ7Jfhfa0w9sM=
+github.com/armosec/k8s-interface v0.0.37/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
+github.com/armosec/k8s-interface v0.0.50 h1:iLPGI0j85vwKANr9QDAnba4Efjg3DyIJg15jRJdvOnc=
+github.com/armosec/k8s-interface v0.0.50/go.mod h1:vHxGWqD/uh6+GQb9Sqv7OGMs+Rvc2dsFVc0XtgRh1ZU=
+github.com/armosec/opa-utils v0.0.64/go.mod h1:6tQP8UDq2EvEfSqh8vrUdr/9QVSCG4sJfju1SXQOn4c=
+github.com/armosec/opa-utils v0.0.75 h1:GBI3K18xc3WXJHIorIu4bGNAsfMYHUc1x7zueDz2ZbY=
+github.com/armosec/opa-utils v0.0.75/go.mod h1:L7d+uiIIXAZ3LEyKtmEIbMcI1hWgWaXGpn5zVCqzwSU=
+github.com/armosec/rbac-utils v0.0.1/go.mod h1:pQ8CBiij8kSKV7aeZm9FMvtZN28VgA7LZcYyTWimq40=
+github.com/armosec/rbac-utils v0.0.9 h1:rIOWp4K7BELUNX32ktSjVbb8d/0SpH7W76W6Tf+8rzw=
+github.com/armosec/rbac-utils v0.0.9/go.mod h1:Ex/IdGWhGv9HZq6Hs8N/ApzCKSIvpNe/ETqDfnuyah0=
 github.com/armosec/utils-go v0.0.2/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
 github.com/armosec/utils-go v0.0.3 h1:uyQI676yRciQM0sSN9uPoqHkbspTxHO0kmzXhBeE/xU=
 github.com/armosec/utils-go v0.0.3/go.mod h1:itWmRLzRdsnwjpEOomL0mBWGnVNNIxSjDAdyc+b0iUo=
@@ -98,6 +103,8 @@ github.com/armosec/utils-k8s-go v0.0.1 h1:Ay3y7fW+4+FjVc0+obOWm8YsnEvM31vPAVoKTy
 github.com/armosec/utils-k8s-go v0.0.1/go.mod h1:qrU4pmY2iZsOb39Eltpm0sTTNM3E4pmeyWx4dgDUC2U=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/aws/aws-sdk-go v1.41.1/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
+github.com/aws/aws-sdk-go v1.41.11 h1:QLouWsiYQ8i22kD8k58Dpdhio1A0MpT7bg9ZNXqEjuI=
+github.com/aws/aws-sdk-go v1.41.11/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -110,8 +117,8 @@ github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqO
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
-github.com/briandowns/spinner v1.16.0 h1:DFmp6hEaIx2QXXuqSJmtfSBSAjRmpGiKG6ip2Wm/yOs=
-github.com/briandowns/spinner v1.16.0/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ=
+github.com/briandowns/spinner v1.18.0 h1:SJs0maNOs4FqhBwiJ3Gr7Z1D39/rukIVGQvpNZVHVcM=
+github.com/briandowns/spinner v1.18.0/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ=
 github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
 github.com/bytecodealliance/wasmtime-go v0.30.0 h1:WfYpr4WdqInt8m5/HvYinf+HrSEAIhItKIcth+qb1h4=
 github.com/bytecodealliance/wasmtime-go v0.30.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
@@ -329,9 +336,11 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go v2.0.0+incompatible h1:j0GKcs05QVmm7yesiZq2+9cxHkNK9YM6zKx4D2qucQU=
 github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.0.3/go.mod h1:LLvjysVCY1JZeum8Z6l8qUty8fiNwE08qbEPm1M08qg=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5 h1:sjZBwGj9Jlw33ImPtvFviGYvseOtDM7hkSKB7+Tv3SM=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
 github.com/googleapis/gnostic v0.5.5 h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw=
@@ -376,7 +385,9 @@ github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NH
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
@@ -481,8 +492,9 @@ github.com/open-policy-agent/opa v0.33.1 h1:EJe00U5H82iMsemgxcNm9RFwjW8zPyRMvL+0
 github.com/open-policy-agent/opa v0.33.1/go.mod h1:Zb+IdRe0s7M++Rv/KgyuB0qvxO3CUpQ+ZW5v+w/cRUo=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
+github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -683,8 +695,9 @@ golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 h1:/ZScEX8SfEmUGRHs0gxpqteO5nfNW6axyZbBdw9A12g=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=
+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -880,6 +893,7 @@ golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210817190340-bfb29a6856f2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1006,6 +1020,7 @@ google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34q
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
 google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
 google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
+google.golang.org/api v0.44.0 h1:URs6qR1lAxDsqWITsQXI4ZkGiYJ5dHtRNiCpfs2OeKA=
 google.golang.org/api v0.44.0/go.mod h1:EBOGZqzyhtvMDoxwS97ctnh0zUmYY6CxqXsc1AvkYD8=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1063,6 +1078,7 @@ google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
+google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c h1:wtujag7C+4D6KMoulW9YauvK2lgdvCMS260jsqqBXr0=
 google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
@@ -1087,6 +1103,7 @@ google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAG
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.38.0 h1:/9BgsAsa5nWe26HqOlvlgJnqBuktYOLCgjCPqsa56W0=
 google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
--- a/hostsensorutils/hostsensordeploy.go
+++ b/hostsensorutils/hostsensordeploy.go
@@ -0,0 +1,208 @@
+package hostsensorutils
+
+import (
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/cautils"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/apimachinery/pkg/watch"
+	appsapplyv1 "k8s.io/client-go/applyconfigurations/apps/v1"
+	coreapplyv1 "k8s.io/client-go/applyconfigurations/core/v1"
+)
+
+type HostSensorHandler struct {
+	HostSensorPort     int32
+	HostSensorPodNames map[string]string //map from pod names to node names
+	IsReady            <-chan bool       //readonly chan
+	k8sObj             *k8sinterface.KubernetesApi
+	DaemonSet          *appsv1.DaemonSet
+	podListLock        sync.RWMutex
+	gracePeriod        int64
+}
+
+func NewHostSensorHandler(k8sObj *k8sinterface.KubernetesApi) (*HostSensorHandler, error) {
+
+	if k8sObj == nil {
+		return nil, fmt.Errorf("nil k8s interface received")
+	}
+	hsh := &HostSensorHandler{
+		k8sObj:             k8sObj,
+		HostSensorPodNames: map[string]string{},
+		gracePeriod:        int64(15),
+	}
+	// Don't deploy on cluster with no nodes. Some cloud providers prevents termination of K8s objects for cluster with no nodes!!!
+	if nodeList, err := k8sObj.KubernetesClient.CoreV1().Nodes().List(k8sObj.Context, metav1.ListOptions{}); err != nil || len(nodeList.Items) == 0 {
+		if err == nil {
+			err = fmt.Errorf("no nodes to scan")
+		}
+		return hsh, fmt.Errorf("in NewHostSensorHandler, failed to get nodes list: %v", err)
+	}
+
+	return hsh, nil
+}
+
+func (hsh *HostSensorHandler) Init() error {
+	// deploy the YAML
+	// store namespace + port
+	// store pod names
+	// make sure all pods are running, after X seconds treat has running anyway, and log an error on the pods not running yet
+	cautils.ProgressTextDisplay("Installing host sensor")
+	cautils.StartSpinner()
+	defer cautils.StopSpinner()
+	if err := hsh.applyYAML(); err != nil {
+		return fmt.Errorf("in HostSensorHandler init failed to apply YAML: %v", err)
+	}
+	hsh.populatePodNamesToNodeNames()
+	if err := hsh.checkPodForEachNode(); err != nil {
+		fmt.Printf("failed to validate host-sensor pods status: %v", err)
+	}
+	return nil
+}
+
+func (hsh *HostSensorHandler) applyYAML() error {
+	dec := yaml.NewDocumentDecoder(io.NopCloser(strings.NewReader(hostSensorYAML)))
+	// apply namespace
+	singleYAMLBytes := make([]byte, 4096)
+	if readLen, err := dec.Read(singleYAMLBytes); err != nil {
+		return fmt.Errorf("failed to read YAML of namespace: %v", err)
+	} else {
+		singleYAMLBytes = singleYAMLBytes[:readLen]
+	}
+	namespaceAC := &coreapplyv1.NamespaceApplyConfiguration{}
+	if err := yaml.Unmarshal(singleYAMLBytes, namespaceAC); err != nil {
+		return fmt.Errorf("failed to Unmarshal YAML of namespace: %v", err)
+	}
+	namespaceName := ""
+
+	if ns, err := hsh.k8sObj.KubernetesClient.CoreV1().Namespaces().Apply(hsh.k8sObj.Context, namespaceAC, metav1.ApplyOptions{
+		FieldManager: "kubescape",
+	}); err != nil {
+		return fmt.Errorf("failed to apply YAML of namespace: %v", err)
+	} else {
+		namespaceName = ns.Name
+	}
+	// apply DaemonSet
+	daemonAC := &appsapplyv1.DaemonSetApplyConfiguration{}
+	singleYAMLBytes = make([]byte, 4096)
+	if readLen, err := dec.Read(singleYAMLBytes); err != nil {
+		if erra := hsh.tearDownNamesapce(namespaceName); erra != nil {
+			err = fmt.Errorf("%v; In addidtion %v", err, erra)
+		}
+		return fmt.Errorf("failed to read YAML of DaemonSet: %v", err)
+	} else {
+		singleYAMLBytes = singleYAMLBytes[:readLen]
+	}
+	if err := yaml.Unmarshal(singleYAMLBytes, daemonAC); err != nil {
+		if erra := hsh.tearDownNamesapce(namespaceName); erra != nil {
+			err = fmt.Errorf("%v; In addidtion %v", err, erra)
+		}
+		return fmt.Errorf("failed to Unmarshal YAML of DaemonSet: %v", err)
+	}
+	daemonAC.Namespace = &namespaceName
+	if ds, err := hsh.k8sObj.KubernetesClient.AppsV1().DaemonSets(namespaceName).Apply(hsh.k8sObj.Context, daemonAC, metav1.ApplyOptions{
+		FieldManager: "kubescape",
+	}); err != nil {
+		if erra := hsh.tearDownNamesapce(namespaceName); erra != nil {
+			err = fmt.Errorf("%v; In addidtion %v", err, erra)
+		}
+		return fmt.Errorf("failed to apply YAML of DaemonSet: %v", err)
+	} else {
+		hsh.HostSensorPort = ds.Spec.Template.Spec.Containers[0].Ports[0].ContainerPort
+		hsh.DaemonSet = ds
+	}
+	return nil
+}
+
+func (hsh *HostSensorHandler) checkPodForEachNode() error {
+	deadline := time.Now().Add(time.Second * 100)
+	for {
+		nodesList, err := hsh.k8sObj.KubernetesClient.CoreV1().Nodes().List(hsh.k8sObj.Context, metav1.ListOptions{})
+		if err != nil {
+			return fmt.Errorf("in checkPodsForEveryNode, failed to get nodes list: %v", nodesList)
+		}
+		hsh.podListLock.RLock()
+		podsNum := len(hsh.HostSensorPodNames)
+		hsh.podListLock.RUnlock()
+		if len(nodesList.Items) == podsNum {
+			break
+		}
+		if time.Now().After(deadline) {
+			return fmt.Errorf("host-sensor pods number (%d) differ than nodes number (%d) after deadline exceded", podsNum, len(nodesList.Items))
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	return nil
+}
+
+// initiating routine to keep pod list updated
+func (hsh *HostSensorHandler) populatePodNamesToNodeNames() {
+
+	go func() {
+		watchRes, err := hsh.k8sObj.KubernetesClient.CoreV1().Pods(hsh.DaemonSet.Namespace).Watch(hsh.k8sObj.Context, metav1.ListOptions{
+			Watch:         true,
+			LabelSelector: fmt.Sprintf("name=%s", hsh.DaemonSet.Spec.Template.Labels["name"]),
+		})
+		if err != nil {
+			fmt.Printf("Failed to watch over daemonset pods")
+		}
+		for eve := range watchRes.ResultChan() {
+			pod, ok := eve.Object.(*corev1.Pod)
+			if !ok {
+				continue
+			}
+			go hsh.updatePodInListAtomic(eve.Type, pod)
+		}
+	}()
+}
+
+func (hsh *HostSensorHandler) updatePodInListAtomic(eventType watch.EventType, podObj *corev1.Pod) {
+	hsh.podListLock.Lock()
+	defer hsh.podListLock.Unlock()
+
+	switch eventType {
+	case watch.Added, watch.Modified:
+		if podObj.Status.Phase == corev1.PodRunning {
+			hsh.HostSensorPodNames[podObj.ObjectMeta.Name] = podObj.Spec.NodeName
+		} else {
+			delete(hsh.HostSensorPodNames, podObj.ObjectMeta.Name)
+		}
+	default:
+		delete(hsh.HostSensorPodNames, podObj.ObjectMeta.Name)
+	}
+}
+
+func (hsh *HostSensorHandler) tearDownNamesapce(namespace string) error {
+
+	if err := hsh.k8sObj.KubernetesClient.CoreV1().Namespaces().Delete(hsh.k8sObj.Context, namespace, metav1.DeleteOptions{GracePeriodSeconds: &hsh.gracePeriod}); err != nil {
+		return fmt.Errorf("failed to delete host-sensor namespace: %v", err)
+	}
+	return nil
+}
+
+func (hsh *HostSensorHandler) TearDown() error {
+	namespace := hsh.GetNamespace()
+	if err := hsh.k8sObj.KubernetesClient.AppsV1().DaemonSets(hsh.GetNamespace()).Delete(hsh.k8sObj.Context, hsh.DaemonSet.Name, metav1.DeleteOptions{GracePeriodSeconds: &hsh.gracePeriod}); err != nil {
+		return fmt.Errorf("failed to delete host-sensor daemonset: %v", err)
+	}
+	if err := hsh.tearDownNamesapce(namespace); err != nil {
+		return fmt.Errorf("failed to delete host-sensor daemonset: %v", err)
+	}
+	// TODO: wait for termination? may take up to 120 seconds!!!
+
+	return nil
+}
+
+func (hsh *HostSensorHandler) GetNamespace() string {
+	if hsh.DaemonSet == nil {
+		return ""
+	}
+	return hsh.DaemonSet.Namespace
+}
--- a/hostsensorutils/hostsensorgetfrompod.go
+++ b/hostsensorutils/hostsensorgetfrompod.go
@@ -0,0 +1,183 @@
+package hostsensorutils
+
+import (
+	"encoding/json"
+	"fmt"
+	"sync"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/objectsenvelopes/hostsensor"
+	"sigs.k8s.io/yaml"
+)
+
+func (hsh *HostSensorHandler) getPodList() (res map[string]string, err error) {
+	hsh.podListLock.RLock()
+	jsonBytes, err := json.Marshal(hsh.HostSensorPodNames)
+	hsh.podListLock.RUnlock()
+	if err != nil {
+		return res, fmt.Errorf("failed to marshal pod list: %v", err)
+	}
+	err = json.Unmarshal(jsonBytes, &res)
+	if err != nil {
+		return res, fmt.Errorf("failed to unmarshal pod list: %v", err)
+	}
+	return res, nil
+}
+
+func (hsh *HostSensorHandler) HTTPGetToPod(podName, path string) ([]byte, error) {
+	//  send the request to the port
+
+	restProxy := hsh.k8sObj.KubernetesClient.CoreV1().Pods(hsh.DaemonSet.Namespace).ProxyGet("http", podName, fmt.Sprintf("%d", hsh.HostSensorPort), path, map[string]string{})
+	return restProxy.DoRaw(hsh.k8sObj.Context)
+
+}
+
+func (hsh *HostSensorHandler) ForwardToPod(podName, path string) ([]byte, error) {
+	// NOT IN USE:
+	// ---
+	// spawn port forwarding
+	// req := hsh.k8sObj.KubernetesClient.CoreV1().RESTClient().Post()
+	// req = req.Name(podName)
+	// req = req.Namespace(hsh.DaemonSet.Namespace)
+	// req = req.Resource("pods")
+	// req = req.SubResource("portforward")
+	// ----
+	// https://github.com/gianarb/kube-port-forward
+	// fullPath := fmt.Sprintf("/api/v1/namespaces/%s/pods/%s/portforward",
+	// 	hsh.DaemonSet.Namespace, podName)
+	// transport, upgrader, err := spdy.RoundTripperFor(hsh.k8sObj.KubernetesClient.config)
+	// if err != nil {
+	// 	return nil, err
+	// }
+	// hostIP := strings.TrimLeft(req.RestConfig.Host, "htps:/")
+	// dialer := spdy.NewDialer(upgrader, &http.Client{Transport: transport}, http.MethodPost, &url.URL{Scheme: "http", Path: path, Host: hostIP})
+	return nil, nil
+}
+
+// sendAllPodsHTTPGETRequest fills the raw byte response in the envelope and the node name, but not the GroupVersionKind
+// so the caller is responsible to convert the raw data to some structured data and add the GroupVersionKind details
+func (hsh *HostSensorHandler) sendAllPodsHTTPGETRequest(path, requestKind string) ([]hostsensor.HostSensorDataEnvelope, error) {
+	podList, err := hsh.getPodList()
+	if err != nil {
+		return nil, fmt.Errorf("failed to sendAllPodsHTTPGETRequest: %v", err)
+	}
+	res := make([]hostsensor.HostSensorDataEnvelope, 0, len(podList))
+	resLock := sync.Mutex{}
+	wg := sync.WaitGroup{}
+	wg.Add(len(podList))
+	for podName := range podList {
+		go func(podName, path string) {
+			defer wg.Done()
+			resBytes, err := hsh.HTTPGetToPod(podName, path)
+			if err != nil {
+				fmt.Printf("In sendAllPodsHTTPGETRequest failed to get data '%s' from pod '%s': %v", path, podName, err)
+			} else {
+				resLock.Lock()
+				defer resLock.Unlock()
+				hostSensorDataEnvelope := hostsensor.HostSensorDataEnvelope{}
+				hostSensorDataEnvelope.SetApiVersion(k8sinterface.JoinGroupVersion(hostsensor.GroupHostSensor, hostsensor.Version))
+				hostSensorDataEnvelope.SetKind(requestKind)
+				hostSensorDataEnvelope.SetName(podList[podName])
+				hostSensorDataEnvelope.SetData(resBytes)
+				res = append(res, hostSensorDataEnvelope)
+			}
+
+		}(podName, path)
+	}
+	wg.Wait()
+	return res, nil
+}
+
+// return list of OpenPortsList
+func (hsh *HostSensorHandler) GetOpenPortsList() ([]hostsensor.HostSensorDataEnvelope, error) {
+	// loop over pods and port-forward it to each of them
+	return hsh.sendAllPodsHTTPGETRequest("/openedPorts", "OpenPortsList")
+}
+
+// return list of LinuxSecurityHardeningStatus
+func (hsh *HostSensorHandler) GetLinuxSecurityHardeningStatus() ([]hostsensor.HostSensorDataEnvelope, error) {
+	// loop over pods and port-forward it to each of them
+	return hsh.sendAllPodsHTTPGETRequest("/linuxSecurityHardening", "LinuxSecurityHardeningStatus")
+}
+
+// return list of KubeletCommandLine
+func (hsh *HostSensorHandler) GetKubeletCommandLine() ([]hostsensor.HostSensorDataEnvelope, error) {
+	// loop over pods and port-forward it to each of them
+	return hsh.sendAllPodsHTTPGETRequest("/kubeletCommandLine", "KubeletCommandLine")
+}
+
+// return list of
+func (hsh *HostSensorHandler) GetKernelVersion() ([]hostsensor.HostSensorDataEnvelope, error) {
+	// loop over pods and port-forward it to each of them
+	return hsh.sendAllPodsHTTPGETRequest("/kernelVersion", "KernelVersion")
+}
+
+// return list of
+func (hsh *HostSensorHandler) GetOsReleaseFile() ([]hostsensor.HostSensorDataEnvelope, error) {
+	// loop over pods and port-forward it to each of them
+	return hsh.sendAllPodsHTTPGETRequest("/osRelease", "OsReleaseFile")
+}
+
+// return list of
+func (hsh *HostSensorHandler) GetKubeletConfigurations() ([]hostsensor.HostSensorDataEnvelope, error) {
+	// loop over pods and port-forward it to each of them
+	res, err := hsh.sendAllPodsHTTPGETRequest("/kubeletConfigurations", "KubeletConfigurations") // empty kind, will be overridden
+	for resIdx := range res {
+		jsonBytes, err := yaml.YAMLToJSON(res[resIdx].Data)
+		if err != nil {
+			fmt.Printf("In GetKubeletConfigurations failed to YAMLToJSON: %v;\n%v", err, res[resIdx])
+			continue
+		}
+		res[resIdx].SetData(jsonBytes)
+	}
+	return res, err
+}
+
+func (hsh *HostSensorHandler) CollectResources() ([]hostsensor.HostSensorDataEnvelope, error) {
+	res := make([]hostsensor.HostSensorDataEnvelope, 0)
+	if hsh.DaemonSet == nil {
+		return res, nil
+	}
+	cautils.ProgressTextDisplay("Accessing host sensor")
+	cautils.StartSpinner()
+	defer cautils.StopSpinner()
+	kcData, err := hsh.GetKubeletConfigurations()
+	if err != nil {
+		return kcData, err
+	}
+	res = append(res, kcData...)
+	//
+	kcData, err = hsh.GetKubeletCommandLine()
+	if err != nil {
+		return kcData, err
+	}
+	res = append(res, kcData...)
+	//
+	kcData, err = hsh.GetOsReleaseFile()
+	if err != nil {
+		return kcData, err
+	}
+	res = append(res, kcData...)
+	//
+	kcData, err = hsh.GetKernelVersion()
+	if err != nil {
+		return kcData, err
+	}
+	res = append(res, kcData...)
+	//
+	kcData, err = hsh.GetLinuxSecurityHardeningStatus()
+	if err != nil {
+		return kcData, err
+	}
+	res = append(res, kcData...)
+	//
+	kcData, err = hsh.GetOpenPortsList()
+	if err != nil {
+		return kcData, err
+	}
+	res = append(res, kcData...)
+	// finish
+	cautils.SuccessTextDisplay("Read host information from host sensor")
+	return res, nil
+}
--- a/hostsensorutils/hostsensorinterface.go
+++ b/hostsensorutils/hostsensorinterface.go
@@ -0,0 +1,10 @@
+package hostsensorutils
+
+import "github.com/armosec/opa-utils/objectsenvelopes/hostsensor"
+
+type IHostSensor interface {
+	Init() error
+	TearDown() error
+	CollectResources() ([]hostsensor.HostSensorDataEnvelope, error)
+	GetNamespace() string
+}
--- a/hostsensorutils/hostsensormock.go
+++ b/hostsensorutils/hostsensormock.go
@@ -0,0 +1,24 @@
+package hostsensorutils
+
+import (
+	"github.com/armosec/opa-utils/objectsenvelopes/hostsensor"
+)
+
+type HostSensorHandlerMock struct {
+}
+
+func (hshm *HostSensorHandlerMock) Init() error {
+	return nil
+}
+
+func (hshm *HostSensorHandlerMock) TearDown() error {
+	return nil
+}
+
+func (hshm *HostSensorHandlerMock) CollectResources() ([]hostsensor.HostSensorDataEnvelope, error) {
+	return []hostsensor.HostSensorDataEnvelope{}, nil
+}
+
+func (hshm *HostSensorHandlerMock) GetNamespace() string {
+	return ""
+}
--- a/hostsensorutils/hostsensoryamls.go
+++ b/hostsensorutils/hostsensoryamls.go
@@ -0,0 +1,65 @@
+package hostsensorutils
+
+const hostSensorYAML = `apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app: host-sensor
+    kubernetes.io/metadata.name: armo-kube-host-sensor
+    tier: armo-kube-host-sensor-control-plane
+  name: armo-kube-host-sensor
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: host-sensor
+  namespace: armo-kube-host-sensor
+  labels:
+    k8s-app: armo-kube-host-sensor
+spec:
+  selector:
+    matchLabels:
+      name: host-sensor
+  template:
+    metadata:
+      labels:
+        name: host-sensor
+    spec:
+      tolerations:
+      # this toleration is to have the daemonset runnable on master nodes
+      # remove it if your masters can't run pods
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      containers:
+      - name: host-sensor
+        image: quay.io/armosec/kube-host-sensor:latest
+        securityContext:
+          privileged: true
+          readOnlyRootFilesystem: true
+          procMount: Unmasked
+        ports:
+          - name: http
+            hostPort: 7888
+            containerPort: 7888
+        resources:
+          limits:
+            cpu: 1m
+            memory: 200Mi
+          requests:
+            cpu: 1m
+            memory: 200Mi
+        volumeMounts:
+        - mountPath: /host_fs
+          name: host-filesystem
+      terminationGracePeriodSeconds: 120
+      dnsPolicy: ClusterFirstWithHostNet
+      automountServiceAccountToken: false
+      volumes:
+      - hostPath:
+          path: /
+          type: Directory
+        name: host-filesystem
+      hostNetwork: true
+      hostPID: true
+      hostIPC: true`
--- a/install.sh
+++ b/install.sh
@@ -53,6 +53,6 @@ echo -e "\033[0m"
 $KUBESCAPE_EXEC version
 echo

-echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan framework nsa"
+echo -e "\033[35mUsage: $ $KUBESCAPE_EXEC scan --submit"

 echo -e "\033[0m"
--- a/main.go
+++ b/main.go
@@ -1,23 +1,9 @@
 package main

 import (
-	"fmt"
-	"os"
-
 	"github.com/armosec/kubescape/clihandler/cmd"
 )

 func main() {
-	CheckLatestVersion()
 	cmd.Execute()
 }
-
-func CheckLatestVersion() {
-	latest, err := cmd.GetLatestVersion()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "error: %v\n", err)
-	} else if latest != cmd.BuildNumber {
-		fmt.Println("Warning: You are not updated to the latest release: " + latest)
-	}
-
-}
--- a/opaprocessor/processorhandler.go
+++ b/opaprocessor/processorhandler.go
@@ -6,52 +6,49 @@ import (
 	"time"

 	"github.com/armosec/kubescape/cautils"
-	"github.com/armosec/opa-utils/exceptions"
+	"github.com/armosec/opa-utils/objectsenvelopes"
 	"github.com/armosec/opa-utils/reporthandling"
 	"github.com/armosec/opa-utils/score"

+	"github.com/golang/glog"
+
 	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/k8s-interface/workloadinterface"

 	"github.com/armosec/opa-utils/resources"
-	"github.com/golang/glog"
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
-	"github.com/open-policy-agent/opa/storage"
 	uuid "github.com/satori/go.uuid"
 )

 const ScoreConfigPath = "/resources/config"

-var RegoK8sCredentials storage.Store
-
 type OPAProcessorHandler struct {
-	processedPolicy *chan *cautils.OPASessionObj
-	reportResults   *chan *cautils.OPASessionObj
-	// componentConfig    cautils.ComponentConfig
+	processedPolicy      *chan *cautils.OPASessionObj
+	reportResults        *chan *cautils.OPASessionObj
+	regoDependenciesData *resources.RegoDependenciesData
 }

 type OPAProcessor struct {
 	*cautils.OPASessionObj
+	regoDependenciesData *resources.RegoDependenciesData
 }

-func NewOPAProcessor(sessionObj *cautils.OPASessionObj) *OPAProcessor {
+func NewOPAProcessor(sessionObj *cautils.OPASessionObj, regoDependenciesData *resources.RegoDependenciesData) *OPAProcessor {
+	if regoDependenciesData != nil && sessionObj != nil {
+		regoDependenciesData.PostureControlInputs = sessionObj.RegoInputData.PostureControlInputs
+	}
 	return &OPAProcessor{
-		OPASessionObj: sessionObj,
+		OPASessionObj:        sessionObj,
+		regoDependenciesData: regoDependenciesData,
 	}
 }

 func NewOPAProcessorHandler(processedPolicy, reportResults *chan *cautils.OPASessionObj) *OPAProcessorHandler {
-
-	regoDependenciesData := resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName)
-	store, err := regoDependenciesData.TOStorage()
-	if err != nil {
-		panic(err)
-	}
-	RegoK8sCredentials = store
-
 	return &OPAProcessorHandler{
-		processedPolicy: processedPolicy,
-		reportResults:   reportResults,
+		processedPolicy:      processedPolicy,
+		reportResults:        reportResults,
+		regoDependenciesData: resources.NewRegoDependenciesData(k8sinterface.GetK8sConfig(), cautils.ClusterName),
 	}
 }

@@ -59,11 +56,11 @@ func (opaHandler *OPAProcessorHandler) ProcessRulesListenner() {

 	for {
 		opaSessionObj := <-*opaHandler.processedPolicy
-		opap := NewOPAProcessor(opaSessionObj)
+		opap := NewOPAProcessor(opaSessionObj, opaHandler.regoDependenciesData)

 		// process
 		if err := opap.Process(); err != nil {
-			fmt.Println(err)
+			// fmt.Println(err)
 		}

 		// edit results
@@ -71,7 +68,8 @@ func (opaHandler *OPAProcessorHandler) ProcessRulesListenner() {

 		// update score
 		// opap.updateScore()
-
+		scoreutil := score.NewScore(opaSessionObj.AllResources)
+		scoreutil.Calculate(opaSessionObj.PostureReport.FrameworkReports)
 		// report
 		*opaHandler.reportResults <- opaSessionObj
 	}
@@ -86,7 +84,7 @@ func (opap *OPAProcessor) Process() error {
 	for i := range opap.Frameworks {
 		frameworkReport, err := opap.processFramework(&opap.Frameworks[i])
 		if err != nil {
-			errs = fmt.Errorf("%v\n%s", errs, err.Error())
+			appendError(&errs, err)
 		}
 		frameworkReports = append(frameworkReports, *frameworkReport)
 	}
@@ -100,6 +98,16 @@ func (opap *OPAProcessor) Process() error {
 	return errs
 }

+func appendError(errs *error, err error) {
+	if err == nil {
+		return
+	}
+	if errs == nil {
+		errs = &err
+	} else {
+		*errs = fmt.Errorf("%v\n%s", *errs, err.Error())
+	}
+}
 func (opap *OPAProcessor) processFramework(framework *reporthandling.Framework) (*reporthandling.FrameworkReport, error) {
 	var errs error

@@ -110,7 +118,8 @@ func (opap *OPAProcessor) processFramework(framework *reporthandling.Framework)
 	for i := range framework.Controls {
 		controlReport, err := opap.processControl(&framework.Controls[i])
 		if err != nil {
-			errs = fmt.Errorf("%v\n%s", errs, err.Error())
+			appendError(&errs, err)
+			// errs = fmt.Errorf("%v\n%s", errs, err.Error())
 		}
 		if controlReport != nil {
 			controlReports = append(controlReports, *controlReport)
@@ -126,6 +135,8 @@ func (opap *OPAProcessor) processControl(control *reporthandling.Control) (*repo
 	controlReport := reporthandling.ControlReport{}
 	controlReport.PortalBase = control.PortalBase
 	controlReport.ControlID = control.ControlID
+	controlReport.BaseScore = control.BaseScore
+
 	controlReport.Control_ID = control.Control_ID // TODO: delete when 'id' is deprecated

 	controlReport.Name = control.Name
@@ -136,7 +147,7 @@ func (opap *OPAProcessor) processControl(control *reporthandling.Control) (*repo
 	for i := range control.Rules {
 		ruleReport, err := opap.processRule(&control.Rules[i])
 		if err != nil {
-			errs = fmt.Errorf("%v\n%s", errs, err.Error())
+			appendError(&errs, err)
 		}
 		if ruleReport != nil {
 			ruleReports = append(ruleReports, *ruleReport)
@@ -150,31 +161,70 @@ func (opap *OPAProcessor) processControl(control *reporthandling.Control) (*repo
 }

 func (opap *OPAProcessor) processRule(rule *reporthandling.PolicyRule) (*reporthandling.RuleReport, error) {
-	if ruleWithArmoOpaDependency(rule.Attributes) {
+	if ruleWithArmoOpaDependency(rule.Attributes) || !isRuleKubescapeVersionCompatible(rule) {
 		return nil, nil
 	}
-	k8sObjects := getKubernetesObjects(opap.K8SResources, rule.Match)
-	ruleReport, err := opap.runOPAOnSingleRule(rule, k8sObjects)
+
+	inputResources, err := reporthandling.RegoResourcesAggregator(rule, getAllSupportedObjects(opap.K8SResources, opap.AllResources, rule))
 	if err != nil {
+		return nil, fmt.Errorf("error getting aggregated k8sObjects: %s", err.Error())
+	}
+
+	inputRawResources := workloadinterface.ListMetaToMap(inputResources)
+
+	ruleReport, err := opap.runOPAOnSingleRule(rule, inputRawResources, ruleData)
+	if err != nil {
+		// ruleReport.RuleStatus.Status = reporthandling.StatusFailed
 		ruleReport.RuleStatus.Status = "failure"
 		ruleReport.RuleStatus.Message = err.Error()
 		glog.Error(err)
 	} else {
-		ruleReport.RuleStatus.Status = "success"
+		ruleReport.RuleStatus.Status = reporthandling.StatusPassed
 	}
-	ruleReport.ListInputResources = k8sObjects
+
+	// the failed resources are a subgroup of the enumeratedData, so we store the enumeratedData like it was the input data
+	enumeratedData, err := opap.enumerateData(rule, inputRawResources)
+	if err != nil {
+		return nil, err
+	}
+	inputResources = objectsenvelopes.ListMapToMeta(enumeratedData)
+	ruleReport.ListInputKinds = workloadinterface.ListMetaIDs(inputResources)
+
+	for i := range inputResources {
+		opap.AllResources[inputResources[i].GetID()] = inputResources[i]
+	}
+
+	failedResources := objectsenvelopes.ListMapToMeta(ruleReport.GetFailedResources())
+	for i := range failedResources {
+		if r, ok := opap.AllResources[failedResources[i].GetID()]; !ok {
+			opap.AllResources[failedResources[i].GetID()] = r
+		}
+	}
+	warningResources := objectsenvelopes.ListMapToMeta(ruleReport.GetWarnignResources())
+	for i := range warningResources {
+		if r, ok := opap.AllResources[warningResources[i].GetID()]; !ok {
+			opap.AllResources[warningResources[i].GetID()] = r
+		}
+	}
+
+	// remove all data from responses, leave only the metadata
+	keepFields := []string{"kind", "apiVersion", "metadata"}
+	keepMetadataFields := []string{"name", "namespace", "labels"}
+	ruleReport.RemoveData(keepFields, keepMetadataFields)
+
 	return &ruleReport, err
 }

-func (opap *OPAProcessor) runOPAOnSingleRule(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}) (reporthandling.RuleReport, error) {
+func (opap *OPAProcessor) runOPAOnSingleRule(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string) (reporthandling.RuleReport, error) {
 	switch rule.RuleLanguage {
 	case reporthandling.RegoLanguage, reporthandling.RegoLanguage2:
-		return opap.runRegoOnK8s(rule, k8sObjects)
+		return opap.runRegoOnK8s(rule, k8sObjects, getRuleData)
 	default:
 		return reporthandling.RuleReport{}, fmt.Errorf("rule: '%s', language '%v' not supported", rule.Name, rule.RuleLanguage)
 	}
 }
-func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}) (reporthandling.RuleReport, error) {
+
+func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}, getRuleData func(*reporthandling.PolicyRule) string) (reporthandling.RuleReport, error) {
 	var errs error
 	ruleReport := reporthandling.RuleReport{
 		Name: rule.Name,
@@ -185,7 +235,7 @@ func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjec
 	if err != nil {
 		return ruleReport, fmt.Errorf("rule: '%s', %s", rule.Name, err.Error())
 	}
-	modules[rule.Name] = rule.Rule
+	modules[rule.Name] = getRuleData(rule)
 	compiled, err := ast.CompileModules(modules)
 	if err != nil {
 		return ruleReport, fmt.Errorf("in 'runRegoOnSingleRule', failed to compile rule, name: %s, reason: %s", rule.Name, err.Error())
@@ -204,21 +254,24 @@ func (opap *OPAProcessor) runRegoOnK8s(rule *reporthandling.PolicyRule, k8sObjec
 }

 func (opap *OPAProcessor) regoEval(inputObj []map[string]interface{}, compiledRego *ast.Compiler) ([]reporthandling.RuleResponse, error) {
+	store, err := opap.regoDependenciesData.TOStorage() // get store
+	if err != nil {
+		return nil, err
+	}
+
 	rego := rego.New(
 		rego.Query("data.armo_builtins"), // get package name from rule
 		rego.Compiler(compiledRego),
 		rego.Input(inputObj),
-		rego.Store(RegoK8sCredentials),
+		rego.Store(store),
 	)

 	// Run evaluation
 	resultSet, err := rego.Eval(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("in 'regoEval', failed to evaluate rule, reason: %s", err.Error())
+		return nil, err
 	}
 	results, err := reporthandling.ParseRegoResult(&resultSet)
-
-	// results, err := ParseRegoResult(&resultSet)
 	if err != nil {
 		return results, err
 	}
@@ -226,38 +279,14 @@ func (opap *OPAProcessor) regoEval(inputObj []map[string]interface{}, compiledRe
 	return results, nil
 }

-func (opap *OPAProcessor) updateScore() {
+func (opap *OPAProcessor) enumerateData(rule *reporthandling.PolicyRule, k8sObjects []map[string]interface{}) ([]map[string]interface{}, error) {

-	if !k8sinterface.ConnectedToCluster {
-		return
+	if ruleEnumeratorData(rule) == "" {
+		return k8sObjects, nil
 	}
-
-	// calculate score
-	s := score.NewScore(k8sinterface.NewKubernetesApi(), ScoreConfigPath)
-	s.Calculate(opap.PostureReport.FrameworkReports)
-}
-
-func (opap *OPAProcessor) updateResults() {
-	for f := range opap.PostureReport.FrameworkReports {
-		// set exceptions
-		exceptions.SetFrameworkExceptions(&opap.PostureReport.FrameworkReports[f], opap.Exceptions, cautils.ClusterName)
-
-		// set counters
-		reporthandling.SetUniqueResourcesCounter(&opap.PostureReport.FrameworkReports[f])
-
-		// set default score
-		reporthandling.SetDefaultScore(&opap.PostureReport.FrameworkReports[f])
-
-		// edit results - remove data
-
-		// TODO - move function to pkg - use RemoveData
-		for c := range opap.PostureReport.FrameworkReports[f].ControlReports {
-			for r, ruleReport := range opap.PostureReport.FrameworkReports[f].ControlReports[c].RuleReports {
-				// editing the responses -> removing duplications, clearing secret data, etc.
-				opap.PostureReport.FrameworkReports[f].ControlReports[c].RuleReports[r].RuleResponses = editRuleResponses(ruleReport.RuleResponses)
-			}
-		}
-
+	ruleReport, err := opap.runOPAOnSingleRule(rule, k8sObjects, ruleEnumeratorData)
+	if err != nil {
+		return nil, err
 	}
-
+	return ruleReport.GetFailedResources(), nil
 }
--- a/opaprocessor/processorhandler_test.go
+++ b/opaprocessor/processorhandler_test.go
@@ -4,9 +4,12 @@ import (
 	"testing"

 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/objectsenvelopes"
 	"github.com/armosec/opa-utils/reporthandling"
+	"github.com/armosec/opa-utils/resources"

 	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/k8s-interface/workloadinterface"
 	// _ "k8s.io/client-go/plugin/pkg/client/auth"
 )

@@ -17,14 +20,20 @@ func TestProcess(t *testing.T) {

 	// set k8s
 	k8sResources := make(cautils.K8SResources)
-	k8sResources["/v1/pods"] = k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.V1KubeSystemNamespaceMock().Items)
+	allResources := make(map[string]workloadinterface.IMetadata)
+	imetaObj := objectsenvelopes.ListMapToMeta(k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.V1KubeSystemNamespaceMock().Items))
+	for i := range imetaObj {
+		allResources[imetaObj[i].GetID()] = imetaObj[i]
+	}
+	k8sResources["/v1/pods"] = workloadinterface.ListMetaIDs(imetaObj)

 	// set opaSessionObj
 	opaSessionObj := cautils.NewOPASessionObjMock()
 	opaSessionObj.Frameworks = []reporthandling.Framework{*reporthandling.MockFrameworkA()}
 	opaSessionObj.K8SResources = &k8sResources
+	opaSessionObj.AllResources = allResources

-	opap := NewOPAProcessor(opaSessionObj)
+	opap := NewOPAProcessor(opaSessionObj, resources.NewRegoDependenciesDataMock())
 	opap.Process()
 	opap.updateResults()
 	for _, f := range opap.PostureReport.FrameworkReports {
--- a/opaprocessor/processorhandlerutils.go
+++ b/opaprocessor/processorhandlerutils.go
@@ -7,15 +7,40 @@ import (

 	"github.com/armosec/k8s-interface/k8sinterface"
 	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/opa-utils/exceptions"
 	"github.com/armosec/opa-utils/reporthandling"
 	resources "github.com/armosec/opa-utils/resources"

 	"github.com/golang/glog"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )

-func getKubernetesObjects(k8sResources *cautils.K8SResources, match []reporthandling.RuleMatchObjects) []map[string]interface{} {
-	k8sObjects := []map[string]interface{}{}
+func (opap *OPAProcessor) updateResults() {
+	// remove data from all objects
+	for i := range opap.AllResources {
+		removeData(opap.AllResources[i])
+	}
+
+	for f := range opap.PostureReport.FrameworkReports {
+		// set exceptions
+		exceptions.SetFrameworkExceptions(&opap.PostureReport.FrameworkReports[f], opap.Exceptions, cautils.ClusterName)
+
+		// set counters
+		reporthandling.SetUniqueResourcesCounter(&opap.PostureReport.FrameworkReports[f])
+
+		// set default score
+		// reporthandling.SetDefaultScore(&opap.PostureReport.FrameworkReports[f])
+	}
+}
+
+func getAllSupportedObjects(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, rule *reporthandling.PolicyRule) []workloadinterface.IMetadata {
+	k8sObjects := []workloadinterface.IMetadata{}
+	k8sObjects = append(k8sObjects, getKubernetesObjects(k8sResources, allResources, rule.Match)...)
+	k8sObjects = append(k8sObjects, getKubernetesObjects(k8sResources, allResources, rule.DynamicMatch)...)
+	return k8sObjects
+}
+
+func getKubernetesObjects(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, match []reporthandling.RuleMatchObjects) []workloadinterface.IMetadata {
+	k8sObjects := []workloadinterface.IMetadata{}
 	for m := range match {
 		for _, groups := range match[m].APIGroups {
 			for _, version := range match[m].APIVersions {
@@ -24,15 +49,11 @@ func getKubernetesObjects(k8sResources *cautils.K8SResources, match []reporthand
 					for _, groupResource := range groupResources {
 						if k8sObj, ok := (*k8sResources)[groupResource]; ok {
 							if k8sObj == nil {
+								continue
 								// glog.Errorf("Resource '%s' is nil, probably failed to pull the resource", groupResource)
-							} else if v, k := k8sObj.([]map[string]interface{}); k {
-								k8sObjects = append(k8sObjects, v...)
-							} else if v, k := k8sObj.(map[string]interface{}); k {
-								k8sObjects = append(k8sObjects, v)
-							} else if v, k := k8sObj.([]unstructured.Unstructured); k {
-								k8sObjects = append(k8sObjects, k8sinterface.ConvertUnstructuredSliceToMap(v)...) //
-							} else {
-								glog.Errorf("In 'getKubernetesObjects' resource '%s' unknown type", groupResource)
+							}
+							for i := range k8sObj {
+								k8sObjects = append(k8sObjects, allResources[k8sObj[i]])
 							}
 						}
 					}
@@ -52,28 +73,6 @@ func getRuleDependencies() (map[string]string, error) {
 	return modules, nil
 }

-//editRuleResponses editing the responses -> removing duplications, clearing secret data, etc.
-func editRuleResponses(ruleResponses []reporthandling.RuleResponse) []reporthandling.RuleResponse {
-	lenRuleResponses := len(ruleResponses)
-	for i := 0; i < lenRuleResponses; i++ {
-		for j := range ruleResponses[i].AlertObject.K8SApiObjects {
-			w := workloadinterface.NewWorkloadObj(ruleResponses[i].AlertObject.K8SApiObjects[j])
-			if w == nil {
-				continue
-			}
-
-			cleanRuleResponses(w)
-			ruleResponses[i].AlertObject.K8SApiObjects[j] = w.GetWorkload()
-		}
-	}
-	return ruleResponses
-}
-func cleanRuleResponses(workload k8sinterface.IWorkload) {
-	if workload.GetKind() == "Secret" {
-		workload.RemoveSecretData()
-	}
-}
-
 func ruleWithArmoOpaDependency(annotations map[string]interface{}) bool {
 	if annotations == nil {
 		return false
@@ -83,3 +82,88 @@ func ruleWithArmoOpaDependency(annotations map[string]interface{}) bool {
 	}
 	return false
 }
+
+// Checks that kubescape version is in range of use for this rule
+// In local build (BuildNumber = ""):
+// returns true only if rule doesn't have the "until" attribute
+func isRuleKubescapeVersionCompatible(rule *reporthandling.PolicyRule) bool {
+	if from, ok := rule.Attributes["useFromKubescapeVersion"]; ok {
+		if cautils.BuildNumber != "" {
+			if from.(string) > cautils.BuildNumber {
+				return false
+			}
+		}
+	}
+	if until, ok := rule.Attributes["useUntilKubescapeVersion"]; ok {
+		if cautils.BuildNumber != "" {
+			if until.(string) <= cautils.BuildNumber {
+				return false
+			}
+		} else {
+			return false
+		}
+	}
+	return true
+}
+
+func removeData(obj workloadinterface.IMetadata) {
+	if !k8sinterface.IsTypeWorkload(obj.GetObject()) {
+		return // remove data only from kubernetes objects
+	}
+	workload := workloadinterface.NewWorkloadObj(obj.GetObject())
+	switch workload.GetKind() {
+	case "Secret":
+		removeSecretData(workload)
+	case "ConfigMap":
+		removeConfigMapData(workload)
+	default:
+		removePodData(workload)
+	}
+}
+
+func removeConfigMapData(workload workloadinterface.IWorkload) {
+	workload.RemoveAnnotation("kubectl.kubernetes.io/last-applied-configuration")
+	workloadinterface.RemoveFromMap(workload.GetObject(), "metadata", "managedFields")
+	overrideSensitiveData(workload)
+}
+
+func overrideSensitiveData(workload workloadinterface.IWorkload) {
+	dataInterface, ok := workloadinterface.InspectMap(workload.GetObject(), "data")
+	if ok {
+		data, ok := dataInterface.(map[string]interface{})
+		if ok {
+			for key := range data {
+				workloadinterface.SetInMap(workload.GetObject(), []string{"data"}, key, "XXXXXX")
+			}
+		}
+	}
+}
+
+func removeSecretData(workload workloadinterface.IWorkload) {
+	workload.RemoveAnnotation("kubectl.kubernetes.io/last-applied-configuration")
+	workloadinterface.RemoveFromMap(workload.GetObject(), "metadata", "managedFields")
+	overrideSensitiveData(workload)
+}
+func removePodData(workload workloadinterface.IWorkload) {
+	workload.RemoveAnnotation("kubectl.kubernetes.io/last-applied-configuration")
+	workloadinterface.RemoveFromMap(workload.GetObject(), "metadata", "managedFields")
+
+	containers, err := workload.GetContainers()
+	if err != nil || len(containers) == 0 {
+		return
+	}
+	for i := range containers {
+		for j := range containers[i].Env {
+			containers[i].Env[j].Value = "XXXXXX"
+		}
+	}
+	workloadinterface.SetInMap(workload.GetObject(), workloadinterface.PodSpec(workload.GetKind()), "containers", containers)
+}
+
+func ruleData(rule *reporthandling.PolicyRule) string {
+	return rule.Rule
+}
+
+func ruleEnumeratorData(rule *reporthandling.PolicyRule) string {
+	return rule.ResourceEnumerator
+}
--- a/opaprocessor/processorhandlerutils_test.go
+++ b/opaprocessor/processorhandlerutils_test.go
@@ -2,7 +2,73 @@ package opaprocessor

 import (
 	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/armosec/armoapi-go/armotypes"
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/reporthandling"
 )

 func TestGetKubernetesObjects(t *testing.T) {
 }
+
+var rule_v1_0_131 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
+	Attributes: map[string]interface{}{"useUntilKubescapeVersion": "v1.0.132"}}}
+var rule_v1_0_132 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
+	Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.132", "useUntilKubescapeVersion": "v1.0.133"}}}
+var rule_v1_0_133 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
+	Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.133", "useUntilKubescapeVersion": "v1.0.134"}}}
+var rule_v1_0_134 = &reporthandling.PolicyRule{PortalBase: armotypes.PortalBase{
+	Attributes: map[string]interface{}{"useFromKubescapeVersion": "v1.0.134"}}}
+
+func TestIsRuleKubescapeVersionCompatible(t *testing.T) {
+	// local build- no build number
+	// should use only rules that don't have "until"
+	cautils.BuildNumber = ""
+	if isRuleKubescapeVersionCompatible(rule_v1_0_131) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+	if isRuleKubescapeVersionCompatible(rule_v1_0_132) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+	if isRuleKubescapeVersionCompatible(rule_v1_0_133) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+	if !isRuleKubescapeVersionCompatible(rule_v1_0_134) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+
+	// should only use rules that version is in range of use
+	cautils.BuildNumber = "v1.0.133"
+	if isRuleKubescapeVersionCompatible(rule_v1_0_131) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+	if isRuleKubescapeVersionCompatible(rule_v1_0_132) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+	if !isRuleKubescapeVersionCompatible(rule_v1_0_133) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+	if isRuleKubescapeVersionCompatible(rule_v1_0_134) {
+		t.Error("error in isRuleKubescapeVersionCompatible")
+	}
+}
+
+func TestRemoveData(t *testing.T) {
+	k8sinterface.InitializeMapResourcesMock()
+
+	w := `{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":"demoservice-server"},"spec":{"replicas":1,"selector":{"matchLabels":{"app":"demoservice-server"}},"template":{"metadata":{"creationTimestamp":null,"labels":{"app":"demoservice-server"}},"spec":{"containers":[{"env":[{"name":"SERVER_PORT","value":"8089"},{"name":"SLEEP_DURATION","value":"1"},{"name":"DEMO_FOLDERS","value":"/app"},{"name":"ARMO_TEST_NAME","value":"auto_attach_deployment"},{"name":"CAA_ENABLE_CRASH_REPORTER","value":"1"}],"image":"quay.io/armosec/demoservice:v25","imagePullPolicy":"IfNotPresent","name":"demoservice","ports":[{"containerPort":8089,"protocol":"TCP"}],"resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":30}}}}`
+	obj, _ := workloadinterface.NewWorkload([]byte(w))
+	removeData(obj)
+
+	workload := workloadinterface.NewWorkloadObj(obj.GetObject())
+	c, _ := workload.GetContainers()
+	for i := range c {
+		for _, e := range c[i].Env {
+			assert.Equal(t, "XXXXXX", e.Value)
+		}
+	}
+}
--- a/policyhandler/handlenotification.go
+++ b/policyhandler/handlenotification.go
@@ -4,30 +4,23 @@ import (
 	"fmt"

 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/resourcehandler"
 	"github.com/armosec/opa-utils/reporthandling"
-
-	"github.com/armosec/armoapi-go/armotypes"
-	"github.com/armosec/k8s-interface/k8sinterface"
 )

-var supportedFrameworks = []reporthandling.PolicyIdentifier{
-	{Kind: "Framework", Name: "nsa"},
-	{Kind: "Framework", Name: "mitre"},
-}
-
 // PolicyHandler -
 type PolicyHandler struct {
-	k8s *k8sinterface.KubernetesApi
+	resourceHandler resourcehandler.IResourceHandler
 	// we are listening on this chan in opaprocessor/processorhandler.go/ProcessRulesListenner func
 	processPolicy *chan *cautils.OPASessionObj
 	getters       *cautils.Getters
 }

 // CreatePolicyHandler Create ws-handler obj
-func NewPolicyHandler(processPolicy *chan *cautils.OPASessionObj, k8s *k8sinterface.KubernetesApi) *PolicyHandler {
+func NewPolicyHandler(processPolicy *chan *cautils.OPASessionObj, resourceHandler resourcehandler.IResourceHandler) *PolicyHandler {
 	return &PolicyHandler{
-		k8s:           k8s,
-		processPolicy: processPolicy,
+		resourceHandler: resourceHandler,
+		processPolicy:   processPolicy,
 	}
 }

@@ -38,60 +31,33 @@ func (policyHandler *PolicyHandler) HandleNotificationRequest(notification *repo
 	policyHandler.getters = &scanInfo.Getters

 	// get policies
-	frameworks, exceptions, err := policyHandler.getPolicies(notification)
-	if err != nil {
+	if err := policyHandler.getPolicies(notification, opaSessionObj); err != nil {
 		return err
 	}
-	if len(frameworks) == 0 {
-		return fmt.Errorf("empty list of frameworks")
-	}
-	opaSessionObj.Frameworks = frameworks
-	opaSessionObj.Exceptions = exceptions

-	k8sResources, err := policyHandler.getResources(notification, opaSessionObj, scanInfo)
+	err := policyHandler.getResources(notification, opaSessionObj, scanInfo)
 	if err != nil {
 		return err
 	}
-	if k8sResources == nil || len(*k8sResources) == 0 {
+	if opaSessionObj.K8SResources == nil || len(*opaSessionObj.K8SResources) == 0 {
 		return fmt.Errorf("empty list of resources")
 	}
-	opaSessionObj.K8SResources = k8sResources

 	// update channel
 	*policyHandler.processPolicy <- opaSessionObj
 	return nil
 }

-func (policyHandler *PolicyHandler) getPolicies(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) {
+func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) error {

-	cautils.ProgressTextDisplay("Downloading/Loading policy definitions")
-
-	frameworks, exceptions, err := policyHandler.GetPoliciesFromBackend(notification)
+	opaSessionObj.PostureReport.ClusterAPIServerInfo = policyHandler.resourceHandler.GetClusterAPIServerInfo()
+	resourcesMap, allResources, err := policyHandler.resourceHandler.GetResources(opaSessionObj.Frameworks, &notification.Designators)
 	if err != nil {
-		return frameworks, exceptions, err
+		return err
 	}

-	if len(frameworks) == 0 {
-		err := fmt.Errorf("could not download any policies, please check previous logs")
-		return frameworks, exceptions, err
-	}
-	//if notification.Rules
-	cautils.SuccessTextDisplay("Downloaded/Loaded policy")
+	opaSessionObj.K8SResources = resourcesMap
+	opaSessionObj.AllResources = allResources

-	return frameworks, exceptions, nil
-}
-
-func (policyHandler *PolicyHandler) getResources(notification *reporthandling.PolicyNotification, opaSessionObj *cautils.OPASessionObj, scanInfo *cautils.ScanInfo) (*cautils.K8SResources, error) {
-	var k8sResources *cautils.K8SResources
-	var err error
-	if k8sinterface.ConnectedToCluster { // TODO - use interface
-		if opaSessionObj.PostureReport.ClusterAPIServerInfo, err = policyHandler.k8s.KubernetesClient.Discovery().ServerVersion(); err != nil {
-			cautils.ErrorDisplay(fmt.Sprintf("Failed to discover API server inforamtion: %v", err))
-		}
-		k8sResources, err = policyHandler.getK8sResources(opaSessionObj.Frameworks, &notification.Designators, scanInfo.ExcludedNamespaces)
-	} else {
-		k8sResources, err = policyHandler.loadResources(opaSessionObj.Frameworks, scanInfo)
-	}
-
-	return k8sResources, err
+	return nil
 }
--- a/policyhandler/handlepullpolicies.go
+++ b/policyhandler/handlepullpolicies.go
@@ -2,90 +2,71 @@ package policyhandler

 import (
 	"fmt"
-	"strings"

-	"github.com/armosec/armoapi-go/armotypes"
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/opa-utils/reporthandling"
 )

-func (policyHandler *PolicyHandler) GetPoliciesFromBackend(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) {
-	var errs error
+func (policyHandler *PolicyHandler) getPolicies(notification *reporthandling.PolicyNotification, policiesAndResources *cautils.OPASessionObj) error {
+	cautils.ProgressTextDisplay("Downloading/Loading policy definitions")
+
+	frameworks, err := policyHandler.getScanPolicies(notification)
+	if err != nil {
+		return err
+	}
+	if len(frameworks) == 0 {
+		return fmt.Errorf("failed to download policies, please ARMO team for more information")
+	}
+
+	policiesAndResources.Frameworks = frameworks
+
+	// get exceptions
+	exceptionPolicies, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName)
+	if err == nil {
+		policiesAndResources.Exceptions = exceptionPolicies
+	}
+
+	// get account configuration
+	controlsInputs, err := policyHandler.getters.ControlsInputsGetter.GetControlsInputs(cautils.CustomerGUID, cautils.ClusterName)
+	if err == nil {
+		policiesAndResources.RegoInputData.PostureControlInputs = controlsInputs
+	}
+
+	cautils.SuccessTextDisplay("Downloaded/Loaded policy")
+	return nil
+}
+
+func (policyHandler *PolicyHandler) getScanPolicies(notification *reporthandling.PolicyNotification) ([]reporthandling.Framework, error) {
 	frameworks := []reporthandling.Framework{}
-	exceptionPolicies := []armotypes.PostureExceptionPolicy{}
-	// Get - cacli opa get
-	for _, rule := range notification.Rules {
-		switch rule.Kind {
-		case reporthandling.KindFramework:
-			receivedFramework, recExceptionPolicies, err := policyHandler.getFrameworkPolicies(rule.Name)
+
+	switch getScanKind(notification) {
+	case reporthandling.KindFramework: // Download frameworks
+		for _, rule := range notification.Rules {
+			receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(rule.Name)
+			if err != nil {
+				return frameworks, policyDownloadError(err)
+			}
 			if receivedFramework != nil {
 				frameworks = append(frameworks, *receivedFramework)
-				if recExceptionPolicies != nil {
-					exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...)
-				}
-			} else if err != nil {
-				if strings.Contains(err.Error(), "unsupported protocol scheme") {
-					err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag")
-				}
-				return nil, nil, fmt.Errorf("kind: %v, name: %s, error: %s", rule.Kind, rule.Name, err.Error())
 			}
-		case reporthandling.KindControl:
-			receivedControls, recExceptionPolicies, err := policyHandler.getControl(rule.Name)
-			if receivedControls != nil {
-				f := reporthandling.Framework{
-					Controls: receivedControls,
-				}
-				frameworks = append(frameworks, f)
-				if recExceptionPolicies != nil {
-					exceptionPolicies = append(exceptionPolicies, recExceptionPolicies...)
-				}
-			} else if err != nil {
-				if strings.Contains(err.Error(), "unsupported protocol scheme") {
-					err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag")
-				}
-				return nil, nil, fmt.Errorf("error: %s", err.Error())
-			}
-			// TODO: add case for control from file
-		default:
-			err := fmt.Errorf("missing rule kind, expected: %s", reporthandling.KindFramework)
-			errs = fmt.Errorf("%s", err.Error())
 		}
+	case reporthandling.KindControl: // Download controls
+		f := reporthandling.Framework{}
+		var receivedControl *reporthandling.Control
+		var err error
+		for _, rule := range notification.Rules {
+			receivedControl, err = policyHandler.getters.PolicyGetter.GetControl(rule.Name)
+			if err != nil {
+				return frameworks, policyDownloadError(err)
+			}
+			if receivedControl != nil {
+				f.Controls = append(f.Controls, *receivedControl)
+			}
+		}
+		frameworks = append(frameworks, f)
+		// TODO: add case for control from file
+	default:
+		return frameworks, fmt.Errorf("unknown policy kind")
 	}
-	return frameworks, exceptionPolicies, errs
-}
-
-func (policyHandler *PolicyHandler) getFrameworkPolicies(policyName string) (*reporthandling.Framework, []armotypes.PostureExceptionPolicy, error) {
-	receivedFramework, err := policyHandler.getters.PolicyGetter.GetFramework(policyName)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	receivedException, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName)
-	if err != nil {
-		return receivedFramework, nil, err
-	}
-
-	return receivedFramework, receivedException, nil
-}
-
-// Get control by name
-func (policyHandler *PolicyHandler) getControl(policyName string) ([]reporthandling.Control, []armotypes.PostureExceptionPolicy, error) {
-
-	controls := []reporthandling.Control{}
-
-	control, err := policyHandler.getters.PolicyGetter.GetControl(policyName)
-	if err != nil {
-		return nil, nil, err
-	}
-	if control == nil {
-		return nil, nil, fmt.Errorf("control not found")
-	}
-	controls = append(controls, *control)
-
-	exceptions, err := policyHandler.getters.ExceptionsGetter.GetExceptions(cautils.CustomerGUID, cautils.ClusterName)
-	if err != nil {
-		return controls, nil, err
-	}
-
-	return controls, exceptions, nil
+	return frameworks, nil
 }
--- a/policyhandler/handlepullpoliciesutils.go
+++ b/policyhandler/handlepullpoliciesutils.go
@@ -0,0 +1,21 @@
+package policyhandler
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/armosec/opa-utils/reporthandling"
+)
+
+func getScanKind(notification *reporthandling.PolicyNotification) reporthandling.NotificationPolicyKind {
+	if len(notification.Rules) > 0 {
+		return notification.Rules[0].Kind
+	}
+	return "unknown"
+}
+func policyDownloadError(err error) error {
+	if strings.Contains(err.Error(), "unsupported protocol scheme") {
+		err = fmt.Errorf("failed to download from GitHub release, try running with `--use-default` flag")
+	}
+	return err
+}
--- a/policyhandler/k8sresources.go
+++ b/policyhandler/k8sresources.go
@@ -1,107 +0,0 @@
-package policyhandler
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/armosec/kubescape/cautils"
-	"github.com/armosec/opa-utils/reporthandling"
-
-	"github.com/armosec/k8s-interface/k8sinterface"
-
-	"github.com/armosec/armoapi-go/armotypes"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	k8slabels "k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/client-go/dynamic"
-)
-
-const SelectAllResources = "*"
-
-func (policyHandler *PolicyHandler) getK8sResources(frameworks []reporthandling.Framework, designator *armotypes.PortalDesignator, excludedNamespaces string) (*cautils.K8SResources, error) {
-	// get k8s resources
-	cautils.ProgressTextDisplay("Accessing Kubernetes objects")
-
-	// build resources map
-	k8sResourcesMap := setResourceMap(frameworks)
-
-	// get namespace and labels from designator (ignore cluster labels)
-	_, namespace, labels := armotypes.DigestPortalDesignator(designator)
-
-	// pull k8s recourses
-	if err := policyHandler.pullResources(k8sResourcesMap, namespace, labels, excludedNamespaces); err != nil {
-		return k8sResourcesMap, err
-	}
-
-	cautils.SuccessTextDisplay("Accessed successfully to Kubernetes objects, let’s start!!!")
-	return k8sResourcesMap, nil
-}
-
-func (policyHandler *PolicyHandler) pullResources(k8sResources *cautils.K8SResources, namespace string, labels map[string]string, excludedNamespaces string) error {
-
-	var errs error
-	for groupResource := range *k8sResources {
-		apiGroup, apiVersion, resource := k8sinterface.StringToResourceGroup(groupResource)
-		gvr := schema.GroupVersionResource{Group: apiGroup, Version: apiVersion, Resource: resource}
-		result, err := policyHandler.pullSingleResource(&gvr, namespace, labels, excludedNamespaces)
-		if err != nil {
-			// handle error
-			if errs == nil {
-				errs = err
-			} else {
-				errs = fmt.Errorf("%s\n%s", errs, err.Error())
-			}
-		} else {
-			// store result as []map[string]interface{}
-			(*k8sResources)[groupResource] = k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.FilterOutOwneredResources(result))
-		}
-	}
-	return errs
-}
-
-func (policyHandler *PolicyHandler) pullSingleResource(resource *schema.GroupVersionResource, namespace string, labels map[string]string, excludedNamespaces string) ([]unstructured.Unstructured, error) {
-
-	// set labels
-	listOptions := metav1.ListOptions{}
-	if excludedNamespaces != "" {
-		setFieldSelector(&listOptions, resource, excludedNamespaces)
-	}
-	if len(labels) > 0 {
-		set := k8slabels.Set(labels)
-		listOptions.LabelSelector = set.AsSelector().String()
-	}
-
-	// set dynamic object
-	var clientResource dynamic.ResourceInterface
-	if namespace != "" && k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
-		clientResource = policyHandler.k8s.DynamicClient.Resource(*resource).Namespace(namespace)
-	} else {
-		clientResource = policyHandler.k8s.DynamicClient.Resource(*resource)
-	}
-
-	// list resources
-	result, err := clientResource.List(policyHandler.k8s.Context, listOptions)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get resource: %v, namespace: %s, labelSelector: %v, reason: %s", resource, namespace, listOptions.LabelSelector, err.Error())
-	}
-
-	return result.Items, nil
-
-}
-
-func setFieldSelector(listOptions *metav1.ListOptions, resource *schema.GroupVersionResource, excludedNamespaces string) {
-	fieldSelector := "metadata."
-	if resource.Resource == "namespaces" {
-		fieldSelector += "name"
-	} else if k8sinterface.IsNamespaceScope(resource.Group, resource.Resource) {
-		fieldSelector += "namespace"
-	} else {
-		return
-	}
-	excludedNamespacesSlice := strings.Split(excludedNamespaces, ",")
-	for _, excludedNamespace := range excludedNamespacesSlice {
-		listOptions.FieldSelector += fmt.Sprintf("%s!=%s,", fieldSelector, excludedNamespace)
-	}
-}
--- a/resourcehandler/fieldselector.go
+++ b/resourcehandler/fieldselector.go
@@ -0,0 +1,69 @@
+package resourcehandler
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type IFieldSelector interface {
+	GetNamespacesSelectors(*schema.GroupVersionResource) []string
+}
+
+type EmptySelector struct {
+}
+
+func (es *EmptySelector) GetNamespacesSelectors(resource *schema.GroupVersionResource) []string {
+	return []string{""} //
+}
+
+type ExcludeSelector struct {
+	namespace string
+}
+
+func NewExcludeSelector(ns string) *ExcludeSelector {
+	return &ExcludeSelector{namespace: ns}
+}
+
+type IncludeSelector struct {
+	namespace string
+}
+
+func NewIncludeSelector(ns string) *IncludeSelector {
+	return &IncludeSelector{namespace: ns}
+}
+func (es *ExcludeSelector) GetNamespacesSelectors(resource *schema.GroupVersionResource) []string {
+	fieldSelectors := ""
+	for _, n := range strings.Split(es.namespace, ",") {
+		if n != "" {
+			fieldSelectors += getNamespacesSelector(resource, n, "!=") + ","
+		}
+	}
+	return []string{fieldSelectors}
+
+}
+
+func (is *IncludeSelector) GetNamespacesSelectors(resource *schema.GroupVersionResource) []string {
+	fieldSelectors := []string{}
+	for _, n := range strings.Split(is.namespace, ",") {
+		if n != "" {
+			fieldSelectors = append(fieldSelectors, getNamespacesSelector(resource, n, "=="))
+		}
+	}
+	return fieldSelectors
+}
+
+func getNamespacesSelector(resource *schema.GroupVersionResource, ns, operator string) string {
+	fieldSelector := "metadata."
+	if resource.Resource == "namespaces" {
+		fieldSelector += "name"
+	} else if k8sinterface.IsResourceInNamespaceScope(resource.Resource) {
+		fieldSelector += "namespace"
+	} else {
+		return ""
+	}
+	return fmt.Sprintf("%s%s%s", fieldSelector, operator, ns)
+
+}
--- a/resourcehandler/fieldselector_test.go
+++ b/resourcehandler/fieldselector_test.go
@@ -0,0 +1,43 @@
+package resourcehandler
+
+import (
+	"testing"
+
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestGetNamespacesSelector(t *testing.T) {
+	k8sinterface.InitializeMapResourcesMock()
+	assert.Equal(t, "metadata.namespace==default", getNamespacesSelector(&schema.GroupVersionResource{Version: "v1", Resource: "pods"}, "default", "=="))
+	assert.Equal(t, "", getNamespacesSelector(&schema.GroupVersionResource{Version: "v1", Resource: "nodes"}, "default", "=="))
+}
+
+func TestExcludedNamespacesSelectors(t *testing.T) {
+	k8sinterface.InitializeMapResourcesMock()
+
+	es := NewExcludeSelector("default,ingress")
+	selectors := es.GetNamespacesSelectors(&schema.GroupVersionResource{Resource: "pods"})
+	assert.Equal(t, 1, len(selectors))
+	assert.Equal(t, "metadata.namespace!=default,metadata.namespace!=ingress,", selectors[0])
+
+	selectors2 := es.GetNamespacesSelectors(&schema.GroupVersionResource{Resource: "namespaces"})
+	assert.Equal(t, 1, len(selectors2))
+	assert.Equal(t, "metadata.name!=default,metadata.name!=ingress,", selectors2[0])
+}
+
+func TestIncludeNamespacesSelectors(t *testing.T) {
+	k8sinterface.InitializeMapResourcesMock()
+
+	is := NewIncludeSelector("default,ingress")
+	selectors := is.GetNamespacesSelectors(&schema.GroupVersionResource{Resource: "pods"})
+	assert.Equal(t, 2, len(selectors))
+	assert.Equal(t, "metadata.namespace==default", selectors[0])
+	assert.Equal(t, "metadata.namespace==ingress", selectors[1])
+
+	selectors2 := is.GetNamespacesSelectors(&schema.GroupVersionResource{Resource: "namespaces"})
+	assert.Equal(t, 2, len(selectors2))
+	assert.Equal(t, "metadata.name==default", selectors2[0])
+	assert.Equal(t, "metadata.name==ingress", selectors2[1])
+}
--- a/resourcehandler/filesloader.go
+++ b/resourcehandler/filesloader.go
@@ -1,4 +1,4 @@
-package policyhandler
+package resourcehandler

 import (
 	"bytes"
@@ -8,10 +8,13 @@ import (
 	"path/filepath"
 	"strings"

+	"github.com/armosec/armoapi-go/armotypes"
 	"github.com/armosec/k8s-interface/workloadinterface"
+	"k8s.io/apimachinery/pkg/version"

 	"github.com/armosec/k8s-interface/k8sinterface"
 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/objectsenvelopes"
 	"github.com/armosec/opa-utils/reporthandling"

 	"gopkg.in/yaml.v2"
@@ -29,50 +32,73 @@ const (
 	JSON_FILE_FORMAT FileFormat = "json"
 )

-func (policyHandler *PolicyHandler) loadResources(frameworks []reporthandling.Framework, scanInfo *cautils.ScanInfo) (*cautils.K8SResources, error) {
-	workloads := []k8sinterface.IWorkload{}
+// FileResourceHandler handle resources from files and URLs
+type FileResourceHandler struct {
+	inputPatterns []string
+}
+
+func NewFileResourceHandler(inputPatterns []string) *FileResourceHandler {
+	k8sinterface.InitializeMapResourcesMock() // initialize the resource map
+	return &FileResourceHandler{
+		inputPatterns: inputPatterns,
+	}
+}
+
+func (fileHandler *FileResourceHandler) GetResources(frameworks []reporthandling.Framework, designator *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, error) {
+
+	// build resources map
+	// map resources based on framework required resources: map["/group/version/kind"][]<k8s workloads ids>
+	k8sResources := setResourceMap(frameworks)
+	allResources := map[string]workloadinterface.IMetadata{}
+
+	workloads := []workloadinterface.IMetadata{}

 	// load resource from local file system
-	w, err := loadResourcesFromFiles(scanInfo.InputPatterns)
+	w, err := loadResourcesFromFiles(fileHandler.inputPatterns)
 	if err != nil {
-		return nil, err
+		return nil, allResources, err
 	}
 	if w != nil {
 		workloads = append(workloads, w...)
 	}

 	// load resources from url
-	w, err = loadResourcesFromUrl(scanInfo.InputPatterns)
+	w, err = loadResourcesFromUrl(fileHandler.inputPatterns)
 	if err != nil {
-		return nil, err
+		return nil, allResources, err
 	}
 	if w != nil {
 		workloads = append(workloads, w...)
 	}

 	if len(workloads) == 0 {
-		return nil, fmt.Errorf("empty list of workloads - no workloads found")
+		return nil, allResources, fmt.Errorf("empty list of workloads - no workloads found")
 	}

 	// map all resources: map["/group/version/kind"][]<k8s workloads>
-	allResources := mapResources(workloads)
-
-	// build resources map
-	// map resources based on framework required resources: map["/group/version/kind"][]<k8s workloads>
-	k8sResources := setResourceMap(frameworks)
+	mappedResources := mapResources(workloads)

 	// save only relevant resources
-	for i := range allResources {
+	for i := range mappedResources {
 		if _, ok := (*k8sResources)[i]; ok {
-			(*k8sResources)[i] = allResources[i]
+			ids := []string{}
+			for j := range mappedResources[i] {
+				ids = append(ids, mappedResources[i][j].GetID())
+				allResources[mappedResources[i][j].GetID()] = mappedResources[i][j]
+			}
+			(*k8sResources)[i] = ids
 		}
 	}

-	return k8sResources, nil
+	return k8sResources, allResources, nil

 }

-func loadResourcesFromFiles(inputPatterns []string) ([]k8sinterface.IWorkload, error) {
+func (fileHandler *FileResourceHandler) GetClusterAPIServerInfo() *version.Info {
+	return nil
+}
+
+func loadResourcesFromFiles(inputPatterns []string) ([]workloadinterface.IMetadata, error) {
 	files, errs := listFiles(inputPatterns)
 	if len(errs) > 0 {
 		cautils.ErrorDisplay(fmt.Sprintf("%v", errs)) // TODO - print error
@@ -89,32 +115,36 @@ func loadResourcesFromFiles(inputPatterns []string) ([]k8sinterface.IWorkload, e
 }

 // build resources map
-func mapResources(workloads []k8sinterface.IWorkload) map[string][]map[string]interface{} {
-	allResources := map[string][]map[string]interface{}{}
+func mapResources(workloads []workloadinterface.IMetadata) map[string][]workloadinterface.IMetadata {
+
+	allResources := map[string][]workloadinterface.IMetadata{}
 	for i := range workloads {
 		groupVersionResource, err := k8sinterface.GetGroupVersionResource(workloads[i].GetKind())
 		if err != nil {
 			// TODO - print warning
 			continue
 		}
-		if groupVersionResource.Group != workloads[i].GetGroup() || groupVersionResource.Version != workloads[i].GetVersion() {
-			// TODO - print warning
-			continue
+
+		if k8sinterface.IsTypeWorkload(workloads[i].GetObject()) {
+			w := workloadinterface.NewWorkloadObj(workloads[i].GetObject())
+			if groupVersionResource.Group != w.GetGroup() || groupVersionResource.Version != w.GetVersion() {
+				// TODO - print warning
+				continue
+			}
 		}
 		resourceTriplets := k8sinterface.JoinResourceTriplets(groupVersionResource.Group, groupVersionResource.Version, groupVersionResource.Resource)
 		if r, ok := allResources[resourceTriplets]; ok {
-			r = append(r, workloads[i].GetWorkload())
-			allResources[resourceTriplets] = r
+			allResources[resourceTriplets] = append(r, workloads[i])
 		} else {
-			allResources[resourceTriplets] = []map[string]interface{}{workloads[i].GetWorkload()}
+			allResources[resourceTriplets] = []workloadinterface.IMetadata{workloads[i]}
 		}
 	}
 	return allResources

 }

-func loadFiles(filePaths []string) ([]k8sinterface.IWorkload, []error) {
-	workloads := []k8sinterface.IWorkload{}
+func loadFiles(filePaths []string) ([]workloadinterface.IMetadata, []error) {
+	workloads := []workloadinterface.IMetadata{}
 	errs := []error{}
 	for i := range filePaths {
 		f, err := loadFile(filePaths[i])
@@ -134,7 +164,7 @@ func loadFiles(filePaths []string) ([]k8sinterface.IWorkload, []error) {
 func loadFile(filePath string) ([]byte, error) {
 	return os.ReadFile(filePath)
 }
-func readFile(fileContent []byte, fileFromat FileFormat) ([]k8sinterface.IWorkload, []error) {
+func readFile(fileContent []byte, fileFromat FileFormat) ([]workloadinterface.IMetadata, []error) {

 	switch fileFromat {
 	case YAML_FILE_FORMAT:
@@ -168,12 +198,12 @@ func listFiles(patterns []string) ([]string, []error) {
 	return files, errs
 }

-func readYamlFile(yamlFile []byte) ([]k8sinterface.IWorkload, []error) {
+func readYamlFile(yamlFile []byte) ([]workloadinterface.IMetadata, []error) {
 	errs := []error{}

 	r := bytes.NewReader(yamlFile)
 	dec := yaml.NewDecoder(r)
-	yamlObjs := []k8sinterface.IWorkload{}
+	yamlObjs := []workloadinterface.IMetadata{}

 	var t interface{}
 	for dec.Decode(&t) == nil {
@@ -182,7 +212,9 @@ func readYamlFile(yamlFile []byte) ([]k8sinterface.IWorkload, []error) {
 			continue
 		}
 		if obj, ok := j.(map[string]interface{}); ok {
-			yamlObjs = append(yamlObjs, workloadinterface.NewWorkloadObj(obj))
+			if o := objectsenvelopes.NewObject(obj); o != nil {
+				yamlObjs = append(yamlObjs, o)
+			}
 		} else {
 			errs = append(errs, fmt.Errorf("failed to convert yaml file to map[string]interface, file content: %v", j))
 		}
@@ -191,8 +223,8 @@ func readYamlFile(yamlFile []byte) ([]k8sinterface.IWorkload, []error) {
 	return yamlObjs, errs
 }

-func readJsonFile(jsonFile []byte) ([]k8sinterface.IWorkload, []error) {
-	workloads := []k8sinterface.IWorkload{}
+func readJsonFile(jsonFile []byte) ([]workloadinterface.IMetadata, []error) {
+	workloads := []workloadinterface.IMetadata{}
 	var jsonObj interface{}
 	if err := json.Unmarshal(jsonFile, &jsonObj); err != nil {
 		return workloads, []error{err}
@@ -202,11 +234,13 @@ func readJsonFile(jsonFile []byte) ([]k8sinterface.IWorkload, []error) {

 	return workloads, nil
 }
-func convertJsonToWorkload(jsonObj interface{}, workloads *[]k8sinterface.IWorkload) {
+func convertJsonToWorkload(jsonObj interface{}, workloads *[]workloadinterface.IMetadata) {

 	switch x := jsonObj.(type) {
 	case map[string]interface{}:
-		(*workloads) = append(*workloads, workloadinterface.NewWorkloadObj(x))
+		if o := objectsenvelopes.NewObject(x); o != nil {
+			(*workloads) = append(*workloads, o)
+		}
 	case []interface{}:
 		for i := range x {
 			convertJsonToWorkload(x[i], workloads)
--- a/resourcehandler/filesloader_test.go
+++ b/resourcehandler/filesloader_test.go
@@ -1,4 +1,4 @@
-package policyhandler
+package resourcehandler

 import (
 	"fmt"
@@ -41,7 +41,7 @@ func TestLoadFile(t *testing.T) {
 		t.Errorf("%v", err)
 	}
 }
-func TestLoadResources(t *testing.T) {
+func TestMapResources(t *testing.T) {
 	// policyHandler := &PolicyHandler{}
 	// k8sResources, err := policyHandler.loadResources(opaSessionObj.Frameworks, scanInfo)
 	// files, _ := listFiles([]string{onlineBoutiquePath()})
--- a/resourcehandler/k8sresources.go
+++ b/resourcehandler/k8sresources.go
@@ -0,0 +1,217 @@
+package resourcehandler
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/hostsensorutils"
+	"github.com/armosec/opa-utils/objectsenvelopes"
+	"github.com/armosec/opa-utils/reporthandling"
+
+	"github.com/armosec/k8s-interface/cloudsupport"
+	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/k8s-interface/workloadinterface"
+
+	"github.com/armosec/armoapi-go/armotypes"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8slabels "k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/version"
+	"k8s.io/client-go/dynamic"
+)
+
+type K8sResourceHandler struct {
+	k8s               *k8sinterface.KubernetesApi
+	hostSensorHandler hostsensorutils.IHostSensor
+	fieldSelector     IFieldSelector
+	rbacObjectsAPI    *cautils.RBACObjects
+}
+
+func NewK8sResourceHandler(k8s *k8sinterface.KubernetesApi, fieldSelector IFieldSelector, hostSensorHandler hostsensorutils.IHostSensor, rbacObjects *cautils.RBACObjects) *K8sResourceHandler {
+	return &K8sResourceHandler{
+		k8s:               k8s,
+		fieldSelector:     fieldSelector,
+		hostSensorHandler: hostSensorHandler,
+		rbacObjectsAPI:    rbacObjects,
+	}
+}
+
+func (k8sHandler *K8sResourceHandler) GetResources(frameworks []reporthandling.Framework, designator *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, error) {
+	allResources := map[string]workloadinterface.IMetadata{}
+
+	// get k8s resources
+	cautils.ProgressTextDisplay("Accessing Kubernetes objects")
+
+	cautils.StartSpinner()
+
+	// build resources map
+	// map resources based on framework required resources: map["/group/version/kind"][]<k8s workloads ids>
+	k8sResourcesMap := setResourceMap(frameworks)
+
+	// get namespace and labels from designator (ignore cluster labels)
+	_, namespace, labels := armotypes.DigestPortalDesignator(designator)
+
+	// pull k8s recourses
+	if err := k8sHandler.pullResources(k8sResourcesMap, allResources, namespace, labels); err != nil {
+		return k8sResourcesMap, allResources, err
+	}
+	if err := k8sHandler.collectHostResources(allResources, k8sResourcesMap); err != nil {
+		return k8sResourcesMap, allResources, err
+	}
+
+	if err := k8sHandler.collectRbacResources(allResources); err != nil {
+		cautils.WarningDisplay(os.Stdout, "Warning: failed to collect rbac resources\n")
+	}
+	if err := getCloudProviderDescription(allResources, k8sResourcesMap); err != nil {
+		cautils.WarningDisplay(os.Stdout, fmt.Sprintf("Warning: %v\n", err.Error()))
+	}
+
+	cautils.StopSpinner()
+
+	cautils.SuccessTextDisplay("Accessed successfully to Kubernetes objects")
+	return k8sResourcesMap, allResources, nil
+}
+
+func (k8sHandler *K8sResourceHandler) GetClusterAPIServerInfo() *version.Info {
+	clusterAPIServerInfo, err := k8sHandler.k8s.DiscoveryClient.ServerVersion()
+	if err != nil {
+		cautils.ErrorDisplay(fmt.Sprintf("Failed to discover API server information: %v", err))
+		return nil
+	}
+	return clusterAPIServerInfo
+}
+
+func (k8sHandler *K8sResourceHandler) pullResources(k8sResources *cautils.K8SResources, allResources map[string]workloadinterface.IMetadata, namespace string, labels map[string]string) error {
+
+	var errs error
+	for groupResource := range *k8sResources {
+		apiGroup, apiVersion, resource := k8sinterface.StringToResourceGroup(groupResource)
+		gvr := schema.GroupVersionResource{Group: apiGroup, Version: apiVersion, Resource: resource}
+		result, err := k8sHandler.pullSingleResource(&gvr, namespace, labels)
+		if err != nil {
+			if !strings.Contains(err.Error(), "the server could not find the requested resource") {
+				// handle error
+				if errs == nil {
+					errs = err
+				} else {
+					errs = fmt.Errorf("%s\n%s", errs, err.Error())
+				}
+			}
+			continue
+		}
+		// store result as []map[string]interface{}
+		metaObjs := ConvertMapListToMeta(k8sinterface.ConvertUnstructuredSliceToMap(k8sinterface.FilterOutOwneredResources(result)))
+		for i := range metaObjs {
+			allResources[metaObjs[i].GetID()] = metaObjs[i]
+		}
+		(*k8sResources)[groupResource] = workloadinterface.ListMetaIDs(metaObjs)
+	}
+	return errs
+}
+
+func (k8sHandler *K8sResourceHandler) pullSingleResource(resource *schema.GroupVersionResource, namespace string, labels map[string]string) ([]unstructured.Unstructured, error) {
+	resourceList := []unstructured.Unstructured{}
+	// set labels
+	listOptions := metav1.ListOptions{}
+	fieldSelectors := k8sHandler.fieldSelector.GetNamespacesSelectors(resource)
+	for i := range fieldSelectors {
+
+		listOptions.FieldSelector = fieldSelectors[i]
+
+		if len(labels) > 0 {
+			set := k8slabels.Set(labels)
+			listOptions.LabelSelector = set.AsSelector().String()
+		}
+
+		// set dynamic object
+		var clientResource dynamic.ResourceInterface
+		if namespace != "" && k8sinterface.IsNamespaceScope(resource) {
+			clientResource = k8sHandler.k8s.DynamicClient.Resource(*resource).Namespace(namespace)
+		} else {
+			clientResource = k8sHandler.k8s.DynamicClient.Resource(*resource)
+		}
+
+		// list resources
+		result, err := clientResource.List(context.Background(), listOptions)
+		if err != nil || result == nil {
+			return nil, fmt.Errorf("failed to get resource: %v, namespace: %s, labelSelector: %v, reason: %v", resource, namespace, listOptions.LabelSelector, err)
+		}
+
+		resourceList = append(resourceList, result.Items...)
+
+	}
+
+	return resourceList, nil
+
+}
+func ConvertMapListToMeta(resourceMap []map[string]interface{}) []workloadinterface.IMetadata {
+	workloads := []workloadinterface.IMetadata{}
+	for i := range resourceMap {
+		if w := objectsenvelopes.NewObject(resourceMap[i]); w != nil {
+			workloads = append(workloads, w)
+		}
+	}
+	return workloads
+}
+
+func (k8sHandler *K8sResourceHandler) collectHostResources(allResources map[string]workloadinterface.IMetadata, resourcesMap *cautils.K8SResources) error {
+	hostResources, err := k8sHandler.hostSensorHandler.CollectResources()
+	if err != nil {
+		return err
+	}
+	for rscIdx := range hostResources {
+		group, version := getGroupNVersion(hostResources[rscIdx].GetApiVersion())
+		groupResource := k8sinterface.JoinResourceTriplets(group, version, hostResources[rscIdx].GetKind())
+		allResources[hostResources[rscIdx].GetID()] = &hostResources[rscIdx]
+
+		grpResourceList, ok := (*resourcesMap)[groupResource]
+		if !ok {
+			grpResourceList = make([]string, 0)
+		}
+		(*resourcesMap)[groupResource] = append(grpResourceList, hostResources[rscIdx].GetID())
+	}
+	return nil
+}
+
+func (k8sHandler *K8sResourceHandler) collectRbacResources(allResources map[string]workloadinterface.IMetadata) error {
+	if k8sHandler.rbacObjectsAPI == nil {
+		return nil
+	}
+	allRbacResources, err := k8sHandler.rbacObjectsAPI.ListAllResources()
+	if err != nil {
+		return err
+	}
+	for k, v := range allRbacResources {
+		allResources[k] = v
+	}
+	return nil
+}
+
+func getCloudProviderDescription(allResources map[string]workloadinterface.IMetadata, k8sResourcesMap *cautils.K8SResources) error {
+	if cloudsupport.IsRunningInCloudProvider() {
+		wl, err := cloudsupport.GetDescriptiveInfoFromCloudProvider()
+		if err != nil {
+			cluster := k8sinterface.GetCurrentContext().Cluster
+			provider := cloudsupport.GetCloudProvider(cluster)
+			// Return error with useful info on how to configure credentials for getting cloud provider info
+			switch provider {
+			case "gke":
+				return fmt.Errorf("could not get descriptive information about gke cluster: %s using sdk client. See https://developers.google.com/accounts/docs/application-default-credentials for more information", cluster)
+			case "eks":
+				return fmt.Errorf("could not get descriptive information about eks cluster: %s using sdk client. Check out how to configure credentials in https://docs.aws.amazon.com/sdk-for-go/api/", cluster)
+			case "aks":
+				return fmt.Errorf("could not get descriptive information about aks cluster: %s. %v", cluster, err.Error())
+			}
+			return err
+		}
+		allResources[wl.GetID()] = wl
+		(*k8sResourcesMap)[fmt.Sprintf("%s/%s", wl.GetApiVersion(), wl.GetKind())] = []string{wl.GetID()}
+	}
+	return nil
+
+}
--- a/resourcehandler/k8sresourcesutils.go
+++ b/resourcehandler/k8sresourcesutils.go
@@ -1,6 +1,8 @@
-package policyhandler
+package resourcehandler

 import (
+	"strings"
+
 	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/opa-utils/reporthandling"

@@ -66,3 +68,15 @@ func insertK8sResources(k8sResources map[string]map[string]map[string]interface{
 		}
 	}
 }
+
+func getGroupNVersion(apiVersion string) (string, string) {
+	gv := strings.Split(apiVersion, "/")
+	group, version := "", ""
+	if len(gv) >= 1 {
+		group = gv[0]
+	}
+	if len(gv) >= 2 {
+		version = gv[1]
+	}
+	return group, version
+}
--- a/resourcehandler/k8sresourcesutils_test.go
+++ b/resourcehandler/k8sresourcesutils_test.go
@@ -1,4 +1,4 @@
-package policyhandler
+package resourcehandler

 import (
 	"github.com/armosec/k8s-interface/k8sinterface"
@@ -11,6 +11,7 @@ func TestGetK8sResources(t *testing.T) {
 	// getK8sResources
 }
 func TestSetResourceMap(t *testing.T) {
+	k8sinterface.InitializeMapResourcesMock()
 	framework := reporthandling.MockFrameworkA()
 	k8sResources := setResourceMap([]reporthandling.Framework{*framework})
 	resources := k8sinterface.ResourceGroupToString("*", "v1", "Pod")
--- a/resourcehandler/repositoryscanner.go
+++ b/resourcehandler/repositoryscanner.go
@@ -1,4 +1,4 @@
-package policyhandler
+package resourcehandler

 import (
 	"encoding/json"
@@ -95,7 +95,7 @@ func (g *GitHubRepository) setBranch(branchOptional string) error {
 	// By default it is "master", unless the branchOptional came with a value
 	if branchOptional == "" {

-		body, err := getter.HttpGetter(&http.Client{}, g.defaultBranchAPI())
+		body, err := getter.HttpGetter(&http.Client{}, g.defaultBranchAPI(), nil)
 		if err != nil {
 			return err
 		}
@@ -117,7 +117,7 @@ func (g *GitHubRepository) defaultBranchAPI() string {
 }

 func (g *GitHubRepository) setTree() error {
-	body, err := getter.HttpGetter(&http.Client{}, g.treeAPI())
+	body, err := getter.HttpGetter(&http.Client{}, g.treeAPI(), nil)
 	if err != nil {
 		return err
 	}
--- a/resourcehandler/resourceshandler.go
+++ b/resourcehandler/resourceshandler.go
@@ -0,0 +1,14 @@
+package resourcehandler
+
+import (
+	"github.com/armosec/armoapi-go/armotypes"
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/reporthandling"
+	"k8s.io/apimachinery/pkg/version"
+)
+
+type IResourceHandler interface {
+	GetResources([]reporthandling.Framework, *armotypes.PortalDesignator) (*cautils.K8SResources, map[string]workloadinterface.IMetadata, error)
+	GetClusterAPIServerInfo() *version.Info
+}
--- a/resourcehandler/urlloader.go
+++ b/resourcehandler/urlloader.go
@@ -1,4 +1,4 @@
-package policyhandler
+package resourcehandler

 import (
 	"bytes"
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"strings"

-	"github.com/armosec/k8s-interface/k8sinterface"
+	"github.com/armosec/k8s-interface/workloadinterface"
 	"github.com/armosec/kubescape/cautils"
 )

-func loadResourcesFromUrl(inputPatterns []string) ([]k8sinterface.IWorkload, error) {
+func loadResourcesFromUrl(inputPatterns []string) ([]workloadinterface.IMetadata, error) {
 	urls := listUrls(inputPatterns)
 	if len(urls) == 0 {
 		return nil, nil
@@ -43,8 +43,8 @@ func listUrls(patterns []string) []string {
 	return urls
 }

-func downloadFiles(urls []string) ([]k8sinterface.IWorkload, []error) {
-	workloads := []k8sinterface.IWorkload{}
+func downloadFiles(urls []string) ([]workloadinterface.IMetadata, []error) {
+	workloads := []workloadinterface.IMetadata{}
 	errs := []error{}
 	for i := range urls {
 		f, err := downloadFile(urls[i])
--- a/resultshandling/printer/jsonprinter.go
+++ b/resultshandling/printer/jsonprinter.go
@@ -0,0 +1,42 @@
+package printer
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/armosec/kubescape/cautils"
+)
+
+type JsonPrinter struct {
+	writer *os.File
+}
+
+func NewJsonPrinter() *JsonPrinter {
+	return &JsonPrinter{}
+}
+
+func (jsonPrinter *JsonPrinter) SetWriter(outputFile string) {
+	jsonPrinter.writer = getWriter(outputFile)
+}
+
+func (jsonPrinter *JsonPrinter) Score(score float32) {
+	fmt.Printf("\nFinal score: %d", int(score*100))
+}
+
+func (jsonPrinter *JsonPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
+	var postureReportStr []byte
+	var err error
+
+	if len(opaSessionObj.PostureReport.FrameworkReports) == 1 {
+		postureReportStr, err = json.Marshal(opaSessionObj.PostureReport.FrameworkReports[0])
+	} else {
+		postureReportStr, err = json.Marshal(opaSessionObj.PostureReport.FrameworkReports)
+	}
+
+	if err != nil {
+		fmt.Println("Failed to convert posture report object!")
+		os.Exit(1)
+	}
+	jsonPrinter.writer.Write(postureReportStr)
+}
--- a/resultshandling/printer/junit.go
+++ b/resultshandling/printer/junit.go
@@ -3,10 +3,42 @@ package printer
 import (
 	"encoding/xml"
 	"fmt"
+	"os"

+	"github.com/armosec/kubescape/cautils"
 	"github.com/armosec/opa-utils/reporthandling"
 )

+type JunitPrinter struct {
+	writer *os.File
+}
+
+func NewJunitPrinter() *JunitPrinter {
+	return &JunitPrinter{}
+}
+
+func (junitPrinter *JunitPrinter) SetWriter(outputFile string) {
+	junitPrinter.writer = getWriter(outputFile)
+}
+
+func (junitPrinter *JunitPrinter) Score(score float32) {
+	fmt.Printf("\nFinal score: %d", int(score*100))
+}
+
+func (junitPrinter *JunitPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
+	junitResult, err := convertPostureReportToJunitResult(opaSessionObj.PostureReport)
+	if err != nil {
+		fmt.Println("Failed to convert posture report object!")
+		os.Exit(1)
+	}
+	postureReportStr, err := xml.Marshal(junitResult)
+	if err != nil {
+		fmt.Println("Failed to convert posture report object!")
+		os.Exit(1)
+	}
+	junitPrinter.writer.Write(postureReportStr)
+}
+
 type JUnitTestSuites struct {
 	XMLName xml.Name         `xml:"testsuites"`
 	Suites  []JUnitTestSuite `xml:"testsuite"`
@@ -71,12 +103,12 @@ func convertPostureReportToJunitResult(postureResult *reporthandling.PostureRepo
 			testCase := JUnitTestCase{}
 			testCase.Name = controlReports.Name
 			testCase.Classname = "Kubescape"
-			testCase.Time = "0"
+			testCase.Time = postureResult.ReportGenerationTime.String()
 			if 0 < len(controlReports.RuleReports[0].RuleResponses) {

-				testCase.Resources = framework.GetNumberOfResources()
-				testCase.Excluded = framework.GetNumberOfWarningResources()
-				testCase.Failed = framework.GetNumberOfFailedResources()
+				testCase.Resources = controlReports.GetNumberOfResources()
+				testCase.Excluded = controlReports.GetNumberOfWarningResources()
+				testCase.Failed = controlReports.GetNumberOfFailedResources()
 				failure := JUnitFailure{}
 				failure.Message = fmt.Sprintf("%d resources failed", testCase.Failed)
 				for _, ruleResponses := range controlReports.RuleReports[0].RuleResponses {
--- a/resultshandling/printer/prettyprinter.go
+++ b/resultshandling/printer/prettyprinter.go
@@ -0,0 +1,281 @@
+package printer
+
+import (
+	"fmt"
+	"os"
+	"sort"
+	"strings"
+
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/objectsenvelopes"
+	"github.com/armosec/opa-utils/reporthandling"
+	"github.com/enescakir/emoji"
+	"github.com/olekukonko/tablewriter"
+)
+
+type PrettyPrinter struct {
+	writer             *os.File
+	summary            Summary
+	verboseMode        bool
+	sortedControlNames []string
+	frameworkSummary   ResultSummary
+}
+
+func NewPrettyPrinter(verboseMode bool) *PrettyPrinter {
+	return &PrettyPrinter{
+		verboseMode: verboseMode,
+		summary:     NewSummary(),
+	}
+}
+
+func (printer *PrettyPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
+	// score := calculatePostureScore(opaSessionObj.PostureReport)
+	failedResources := []string{}
+	warningResources := []string{}
+	allResources := []string{}
+	frameworkNames := []string{}
+
+	var overallRiskScore float32 = 0
+	for _, frameworkReport := range opaSessionObj.PostureReport.FrameworkReports {
+		frameworkNames = append(frameworkNames, frameworkReport.Name)
+		failedResources = reporthandling.GetUniqueResourcesIDs(append(failedResources, frameworkReport.ListResourcesIDs().GetFailedResources()...))
+		warningResources = reporthandling.GetUniqueResourcesIDs(append(warningResources, frameworkReport.ListResourcesIDs().GetWarningResources()...))
+		allResources = reporthandling.GetUniqueResourcesIDs(append(allResources, frameworkReport.ListResourcesIDs().GetAllResources()...))
+		printer.summarySetup(frameworkReport, opaSessionObj.AllResources)
+		overallRiskScore += frameworkReport.Score
+	}
+
+	overallRiskScore /= float32(len(opaSessionObj.PostureReport.FrameworkReports))
+
+	printer.frameworkSummary = ResultSummary{
+		RiskScore:      overallRiskScore,
+		TotalResources: len(allResources),
+		TotalFailed:    len(failedResources),
+		TotalWarning:   len(warningResources),
+	}
+
+	printer.printResults()
+	printer.printSummaryTable(frameworkNames)
+
+}
+
+func (printer *PrettyPrinter) SetWriter(outputFile string) {
+	printer.writer = getWriter(outputFile)
+}
+
+func (printer *PrettyPrinter) Score(score float32) {
+}
+
+func (printer *PrettyPrinter) summarySetup(fr reporthandling.FrameworkReport, allResources map[string]workloadinterface.IMetadata) {
+
+	for _, cr := range fr.ControlReports {
+		if len(cr.RuleReports) == 0 {
+			continue
+		}
+		workloadsSummary := listResultSummary(cr.RuleReports, allResources)
+
+		var passedWorkloads map[string][]WorkloadSummary
+		if printer.verboseMode {
+			passedWorkloads = groupByNamespaceOrKind(workloadsSummary, workloadSummaryPassed)
+		}
+
+		//controlSummary
+		printer.summary[cr.Name] = ResultSummary{
+			ID:                cr.ControlID,
+			RiskScore:         cr.Score,
+			TotalResources:    cr.GetNumberOfResources(),
+			TotalFailed:       cr.GetNumberOfFailedResources(),
+			TotalWarning:      cr.GetNumberOfWarningResources(),
+			FailedWorkloads:   groupByNamespaceOrKind(workloadsSummary, workloadSummaryFailed),
+			ExcludedWorkloads: groupByNamespaceOrKind(workloadsSummary, workloadSummaryExclude),
+			PassedWorkloads:   passedWorkloads,
+			Description:       cr.Description,
+			Remediation:       cr.Remediation,
+			ListInputKinds:    cr.ListControlsInputKinds(),
+		}
+
+	}
+	printer.sortedControlNames = printer.getSortedControlsNames()
+}
+func (printer *PrettyPrinter) printResults() {
+	for i := 0; i < len(printer.sortedControlNames); i++ {
+		controlSummary := printer.summary[printer.sortedControlNames[i]]
+		printer.printTitle(printer.sortedControlNames[i], &controlSummary)
+		printer.printResources(&controlSummary)
+		if printer.summary[printer.sortedControlNames[i]].TotalResources > 0 {
+			printer.printSummary(printer.sortedControlNames[i], &controlSummary)
+		}
+
+	}
+}
+
+func (printer *PrettyPrinter) printSummary(controlName string, controlSummary *ResultSummary) {
+	cautils.SimpleDisplay(printer.writer, "Summary - ")
+	cautils.SuccessDisplay(printer.writer, "Passed:%v   ", controlSummary.TotalResources-controlSummary.TotalFailed-controlSummary.TotalWarning)
+	cautils.WarningDisplay(printer.writer, "Excluded:%v   ", controlSummary.TotalWarning)
+	cautils.FailureDisplay(printer.writer, "Failed:%v   ", controlSummary.TotalFailed)
+	cautils.InfoDisplay(printer.writer, "Total:%v\n", controlSummary.TotalResources)
+	if controlSummary.TotalFailed > 0 {
+		cautils.DescriptionDisplay(printer.writer, "Remediation: %v\n", controlSummary.Remediation)
+	}
+	cautils.DescriptionDisplay(printer.writer, "\n")
+
+}
+func (printer *PrettyPrinter) printTitle(controlName string, controlSummary *ResultSummary) {
+	cautils.InfoDisplay(printer.writer, "[control: %s - %s] ", controlName, getControlURL(controlSummary.ID))
+	if controlSummary.TotalResources == 0 {
+		cautils.InfoDisplay(printer.writer, "skipped %v\n", emoji.ConfusedFace)
+	} else if controlSummary.TotalFailed != 0 {
+		cautils.FailureDisplay(printer.writer, "failed %v\n", emoji.SadButRelievedFace)
+	} else if controlSummary.TotalWarning != 0 {
+		cautils.WarningDisplay(printer.writer, "excluded %v\n", emoji.NeutralFace)
+	} else {
+		cautils.SuccessDisplay(printer.writer, "passed %v\n", emoji.ThumbsUp)
+	}
+
+	cautils.DescriptionDisplay(printer.writer, "Description: %s\n", controlSummary.Description)
+
+}
+func (printer *PrettyPrinter) printResources(controlSummary *ResultSummary) {
+
+	if len(controlSummary.FailedWorkloads) > 0 {
+		cautils.FailureDisplay(printer.writer, "Failed:\n")
+		printer.printGroupedResources(controlSummary.FailedWorkloads)
+	}
+	if len(controlSummary.ExcludedWorkloads) > 0 {
+		cautils.WarningDisplay(printer.writer, "Excluded:\n")
+		printer.printGroupedResources(controlSummary.ExcludedWorkloads)
+	}
+	if len(controlSummary.PassedWorkloads) > 0 {
+		cautils.SuccessDisplay(printer.writer, "Passed:\n")
+		printer.printGroupedResources(controlSummary.PassedWorkloads)
+	}
+
+}
+
+func (printer *PrettyPrinter) printGroupedResources(workloads map[string][]WorkloadSummary) {
+	indent := INDENT
+	for title, rsc := range workloads {
+		printer.printGroupedResource(indent, title, rsc)
+	}
+}
+
+func (printer *PrettyPrinter) printGroupedResource(indent string, title string, rsc []WorkloadSummary) {
+	preIndent := indent
+	if title != "" {
+		cautils.SimpleDisplay(printer.writer, "%s%s\n", indent, title)
+		indent += indent
+	}
+
+	for r := range rsc {
+		relatedObjectsStr := generateRelatedObjectsStr(rsc[r])
+		cautils.SimpleDisplay(printer.writer, fmt.Sprintf("%s%s - %s %s\n", indent, rsc[r].resource.GetKind(), rsc[r].resource.GetName(), relatedObjectsStr))
+	}
+	indent = preIndent
+}
+
+func generateRelatedObjectsStr(workload WorkloadSummary) string {
+	relatedStr := ""
+	if workload.resource.GetObjectType() == workloadinterface.TypeWorkloadObject {
+		relatedObjects := objectsenvelopes.NewRegoResponseVectorObject(workload.resource.GetObject()).GetRelatedObjects()
+		for i, related := range relatedObjects {
+			if ns := related.GetNamespace(); i == 0 && ns != "" {
+				relatedStr += fmt.Sprintf("Namespace - %s, ", ns)
+			}
+			relatedStr += fmt.Sprintf("%s - %s, ", related.GetKind(), related.GetName())
+		}
+	}
+	if relatedStr != "" {
+		relatedStr = fmt.Sprintf(" [%s]", relatedStr[:len(relatedStr)-2])
+	}
+	return relatedStr
+}
+
+func generateRow(control string, cs ResultSummary) []string {
+	row := []string{control}
+	row = append(row, cs.ToSlice()...)
+	if cs.TotalResources != 0 {
+		row = append(row, fmt.Sprintf("%d", int(cs.RiskScore))+"%")
+	} else {
+		row = append(row, "skipped")
+	}
+	return row
+}
+
+func generateHeader() []string {
+	return []string{"Control Name", "Failed Resources", "Excluded Resources", "All Resources", "% risk-score"}
+}
+
+func generateFooter(printer *PrettyPrinter) []string {
+	// Control name | # failed resources | all resources | % success
+	row := []string{}
+	row = append(row, "Resource Summary") //fmt.Sprintf(""%d", numControlers"))
+	row = append(row, fmt.Sprintf("%d", printer.frameworkSummary.TotalFailed))
+	row = append(row, fmt.Sprintf("%d", printer.frameworkSummary.TotalWarning))
+	row = append(row, fmt.Sprintf("%d", printer.frameworkSummary.TotalResources))
+	row = append(row, fmt.Sprintf("%.2f%s", printer.frameworkSummary.RiskScore, "%"))
+
+	return row
+}
+func (printer *PrettyPrinter) printSummaryTable(frameworksNames []string) {
+	// For control scan framework will be nil
+	printer.printFramework(frameworksNames)
+
+	summaryTable := tablewriter.NewWriter(printer.writer)
+	summaryTable.SetAutoWrapText(false)
+	summaryTable.SetHeader(generateHeader())
+	summaryTable.SetHeaderLine(true)
+	alignments := []int{tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER}
+	summaryTable.SetColumnAlignment(alignments)
+
+	for i := 0; i < len(printer.sortedControlNames); i++ {
+		controlSummary := printer.summary[printer.sortedControlNames[i]]
+		summaryTable.Append(generateRow(printer.sortedControlNames[i], controlSummary))
+	}
+
+	summaryTable.SetFooter(generateFooter(printer))
+
+	// summaryTable.SetFooter(generateFooter())
+	summaryTable.Render()
+}
+
+func (printer *PrettyPrinter) printFramework(frameworksNames []string) {
+	if len(frameworksNames) == 1 {
+		cautils.InfoTextDisplay(printer.writer, fmt.Sprintf("%s FRAMEWORK\n", frameworksNames[0]))
+	} else if len(frameworksNames) > 1 {
+		p := ""
+		for i := 0; i < len(frameworksNames)-1; i++ {
+			p += frameworksNames[i] + ", "
+		}
+		p += frameworksNames[len(frameworksNames)-1]
+		cautils.InfoTextDisplay(printer.writer, fmt.Sprintf("%s FRAMEWORKS\n", p))
+	}
+}
+
+func (printer *PrettyPrinter) getSortedControlsNames() []string {
+	controlNames := make([]string, 0, len(printer.summary))
+	for k := range printer.summary {
+		controlNames = append(controlNames, k)
+	}
+	sort.Strings(controlNames)
+	return controlNames
+}
+
+func getWriter(outputFile string) *os.File {
+	os.Remove(outputFile)
+	if outputFile != "" {
+		f, err := os.OpenFile(outputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			fmt.Println("failed to open file for writing, reason: ", err.Error())
+			return os.Stdout
+		}
+		return f
+	}
+	return os.Stdout
+
+}
+
+func getControlURL(controlID string) string {
+	return fmt.Sprintf("https://hub.armo.cloud/docs/%s", strings.ToLower(controlID))
+}
--- a/resultshandling/printer/printresults.go
+++ b/resultshandling/printer/printresults.go
@@ -1,271 +1,33 @@
 package printer

 import (
-	"encoding/json"
-	"encoding/xml"
-	"fmt"
-	"os"
-	"sort"
-
 	"github.com/armosec/kubescape/cautils"
-	"github.com/armosec/opa-utils/reporthandling"
-
-	"github.com/enescakir/emoji"
-	"github.com/olekukonko/tablewriter"
 )

 var INDENT = "   "

-const EmptyPercentage = "NaN"
-
 const (
-	PrettyPrinter      string = "pretty-printer"
-	JsonPrinter        string = "json"
-	JunitResultPrinter string = "junit"
+	PrettyFormat      string = "pretty-printer"
+	JsonFormat        string = "json"
+	JunitResultFormat string = "junit"
+	PrometheusFormat  string = "prometheus"
 )

-type Printer struct {
-	writer             *os.File
-	summary            Summary
-	sortedControlNames []string
-	printerType        string
-	frameworkSummary   ControlSummary
+type IPrinter interface {
+	ActionPrint(opaSessionObj *cautils.OPASessionObj)
+	SetWriter(outputFile string)
+	Score(score float32)
 }

-func NewPrinter(printerType, outputFile string) *Printer {
-	return &Printer{
-		summary:     NewSummary(),
-		writer:      getWriter(outputFile),
-		printerType: printerType,
+func GetPrinter(printFormat string, verboseMode bool) IPrinter {
+	switch printFormat {
+	case JsonFormat:
+		return NewJsonPrinter()
+	case JunitResultFormat:
+		return NewJunitPrinter()
+	case PrometheusFormat:
+		return NewPrometheusPrinter(verboseMode)
+	default:
+		return NewPrettyPrinter(verboseMode)
 	}
 }
-
-func calculatePostureScore(postureReport *reporthandling.PostureReport) float32 {
-	totalResources := 0
-	totalFailed := 0
-	for _, frameworkReport := range postureReport.FrameworkReports {
-		totalFailed += frameworkReport.GetNumberOfFailedResources()
-		totalResources += frameworkReport.GetNumberOfResources()
-	}
-	if totalResources == 0 {
-		return float32(0)
-	}
-	return (float32(totalResources) - float32(totalFailed)) / float32(totalResources)
-}
-
-func (printer *Printer) ActionPrint(opaSessionObj *cautils.OPASessionObj) float32 {
-	score := calculatePostureScore(opaSessionObj.PostureReport)
-
-	if printer.printerType == PrettyPrinter {
-		printer.SummarySetup(opaSessionObj.PostureReport)
-		printer.PrintResults()
-		printer.PrintSummaryTable()
-	} else if printer.printerType == JsonPrinter {
-		postureReportStr, err := json.Marshal(opaSessionObj.PostureReport.FrameworkReports[0])
-		if err != nil {
-			fmt.Println("Failed to convert posture report object!")
-			os.Exit(1)
-		}
-		printer.writer.Write(postureReportStr)
-		fmt.Printf("\nFinal score: %d\n", int(score*100))
-	} else if printer.printerType == JunitResultPrinter {
-		junitResult, err := convertPostureReportToJunitResult(opaSessionObj.PostureReport)
-		if err != nil {
-			fmt.Println("Failed to convert posture report object!")
-			os.Exit(1)
-		}
-		postureReportStr, err := xml.Marshal(junitResult)
-		if err != nil {
-			fmt.Println("Failed to convert posture report object!")
-			os.Exit(1)
-		}
-		printer.writer.Write(postureReportStr)
-		fmt.Printf("\nFinal score: %d\n", int(score*100))
-	} else if !cautils.IsSilent() {
-		fmt.Println("unknown output printer")
-		os.Exit(1)
-	}
-
-	return score
-}
-
-func (printer *Printer) SummarySetup(postureReport *reporthandling.PostureReport) {
-	for _, fr := range postureReport.FrameworkReports {
-		printer.frameworkSummary = ControlSummary{
-			TotalResources: fr.GetNumberOfResources(),
-			TotalFailed:    fr.GetNumberOfFailedResources(),
-			TotalWarnign:   fr.GetNumberOfWarningResources(),
-		}
-		for _, cr := range fr.ControlReports {
-			if len(cr.RuleReports) == 0 {
-				continue
-			}
-			workloadsSummary := listResultSummary(cr.RuleReports)
-
-			printer.summary[cr.Name] = ControlSummary{
-				TotalResources:    cr.GetNumberOfResources(),
-				TotalFailed:       cr.GetNumberOfFailedResources(),
-				TotalWarnign:      cr.GetNumberOfWarningResources(),
-				FailedWorkloads:   groupByNamespace(workloadsSummary, workloadSummaryFailed),
-				ExcludedWorkloads: groupByNamespace(workloadsSummary, workloadSummaryExclude),
-				Description:       cr.Description,
-				Remediation:       cr.Remediation,
-				ListInputKinds:    cr.ListControlsInputKinds(),
-			}
-		}
-	}
-	printer.sortedControlNames = printer.getSortedControlsNames()
-}
-func (printer *Printer) PrintResults() {
-	for i := 0; i < len(printer.sortedControlNames); i++ {
-		controlSummary := printer.summary[printer.sortedControlNames[i]]
-		printer.printTitle(printer.sortedControlNames[i], &controlSummary)
-		printer.printResources(&controlSummary)
-		if printer.summary[printer.sortedControlNames[i]].TotalResources > 0 {
-			printer.printSummary(printer.sortedControlNames[i], &controlSummary)
-		}
-
-	}
-}
-
-func (printer *Printer) printSummary(controlName string, controlSummary *ControlSummary) {
-	cautils.SimpleDisplay(printer.writer, "Summary - ")
-	cautils.SuccessDisplay(printer.writer, "Passed:%v   ", controlSummary.TotalResources-controlSummary.TotalFailed-controlSummary.TotalWarnign)
-	cautils.WarningDisplay(printer.writer, "Excluded:%v   ", controlSummary.TotalWarnign)
-	cautils.FailureDisplay(printer.writer, "Failed:%v   ", controlSummary.TotalFailed)
-	cautils.InfoDisplay(printer.writer, "Total:%v\n", controlSummary.TotalResources)
-	if controlSummary.TotalFailed > 0 {
-		cautils.DescriptionDisplay(printer.writer, "Remediation: %v\n", controlSummary.Remediation)
-	}
-	cautils.DescriptionDisplay(printer.writer, "\n")
-
-}
-
-func (printer *Printer) printTitle(controlName string, controlSummary *ControlSummary) {
-	cautils.InfoDisplay(printer.writer, "[control: %s] ", controlName)
-	if controlSummary.TotalResources == 0 {
-		cautils.InfoDisplay(printer.writer, "resources not found %v\n", emoji.ConfusedFace)
-	} else if controlSummary.TotalFailed != 0 {
-		cautils.FailureDisplay(printer.writer, "failed %v\n", emoji.SadButRelievedFace)
-	} else if controlSummary.TotalWarnign != 0 {
-		cautils.WarningDisplay(printer.writer, "excluded %v\n", emoji.NeutralFace)
-	} else {
-		cautils.SuccessDisplay(printer.writer, "passed %v\n", emoji.ThumbsUp)
-	}
-
-	cautils.DescriptionDisplay(printer.writer, "Description: %s\n", controlSummary.Description)
-
-}
-func (printer *Printer) printResources(controlSummary *ControlSummary) {
-
-	if len(controlSummary.FailedWorkloads) > 0 {
-		cautils.FailureDisplay(printer.writer, "Failed:\n")
-		printer.printGroupedResources(controlSummary.FailedWorkloads)
-	}
-	if len(controlSummary.ExcludedWorkloads) > 0 {
-		cautils.WarningDisplay(printer.writer, "Excluded:\n")
-		printer.printGroupedResources(controlSummary.ExcludedWorkloads)
-	}
-
-}
-
-func (printer *Printer) printGroupedResources(workloads map[string][]WorkloadSummary) {
-
-	indent := INDENT
-
-	for ns, rsc := range workloads {
-		preIndent := indent
-		if ns != "" {
-			cautils.SimpleDisplay(printer.writer, "%sNamespace %s\n", indent, ns)
-		}
-		preIndent2 := indent
-		for r := range rsc {
-			indent += indent
-			cautils.SimpleDisplay(printer.writer, fmt.Sprintf("%s%s - %s\n", indent, rsc[r].Kind, rsc[r].Name))
-			indent = preIndent2
-		}
-		indent = preIndent
-	}
-
-}
-
-func (printer *Printer) PrintUrl(url string) {
-	cautils.InfoTextDisplay(printer.writer, url)
-}
-
-func generateRow(control string, cs ControlSummary) []string {
-	row := []string{control}
-	row = append(row, cs.ToSlice()...)
-	if cs.TotalResources != 0 {
-		row = append(row, fmt.Sprintf("%d%s", percentage(cs.TotalResources, cs.TotalFailed), "%"))
-	} else {
-		row = append(row, EmptyPercentage)
-	}
-	return row
-}
-
-func generateHeader() []string {
-	return []string{"Control Name", "Failed Resources", "Excluded Resources", "All Resources", "% success"}
-}
-
-func percentage(big, small int) int {
-	if big == 0 {
-		if small == 0 {
-			return 100
-		}
-		return 0
-	}
-	return int(float64(float64(big-small)/float64(big)) * 100)
-}
-func generateFooter(numControlers, sumFailed, sumWarning, sumTotal int) []string {
-	// Control name | # failed resources | all resources | % success
-	row := []string{}
-	row = append(row, "Resource Summary") //fmt.Sprintf(""%d", numControlers"))
-	row = append(row, fmt.Sprintf("%d", sumFailed))
-	row = append(row, fmt.Sprintf("%d", sumWarning))
-	row = append(row, fmt.Sprintf("%d", sumTotal))
-	if sumTotal != 0 {
-		row = append(row, fmt.Sprintf("%d%s", percentage(sumTotal, sumFailed), "%"))
-	} else {
-		row = append(row, EmptyPercentage)
-	}
-	return row
-}
-func (printer *Printer) PrintSummaryTable() {
-	summaryTable := tablewriter.NewWriter(printer.writer)
-	summaryTable.SetAutoWrapText(false)
-	summaryTable.SetHeader(generateHeader())
-	summaryTable.SetHeaderLine(true)
-	alignments := []int{tablewriter.ALIGN_LEFT, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER}
-	summaryTable.SetColumnAlignment(alignments)
-
-	for i := 0; i < len(printer.sortedControlNames); i++ {
-		controlSummary := printer.summary[printer.sortedControlNames[i]]
-		summaryTable.Append(generateRow(printer.sortedControlNames[i], controlSummary))
-	}
-	summaryTable.SetFooter(generateFooter(len(printer.summary), printer.frameworkSummary.TotalFailed, printer.frameworkSummary.TotalWarnign, printer.frameworkSummary.TotalResources))
-	summaryTable.Render()
-}
-
-func (printer *Printer) getSortedControlsNames() []string {
-	controlNames := make([]string, 0, len(printer.summary))
-	for k := range printer.summary {
-		controlNames = append(controlNames, k)
-	}
-	sort.Strings(controlNames)
-	return controlNames
-}
-
-func getWriter(outputFile string) *os.File {
-	os.Remove(outputFile)
-	if outputFile != "" {
-		f, err := os.OpenFile(outputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
-		if err != nil {
-			fmt.Println("Error opening file")
-			return os.Stdout
-		}
-		return f
-	}
-	return os.Stdout
-
-}
--- a/resultshandling/printer/prometheusprinter.go
+++ b/resultshandling/printer/prometheusprinter.go
@@ -0,0 +1,93 @@
+package printer
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/opa-utils/reporthandling"
+)
+
+type PrometheusPrinter struct {
+	writer      *os.File
+	verboseMode bool
+}
+
+func NewPrometheusPrinter(verboseMode bool) *PrometheusPrinter {
+	return &PrometheusPrinter{
+		verboseMode: verboseMode,
+	}
+}
+
+func (prometheusPrinter *PrometheusPrinter) SetWriter(outputFile string) {
+	prometheusPrinter.writer = getWriter(outputFile)
+}
+
+func (prometheusPrinter *PrometheusPrinter) Score(score float32) {
+	fmt.Printf("\n# Overall score out of 100\nkubescape_score %f\n", score*100)
+}
+
+func (printer *PrometheusPrinter) printResources(allResources map[string]workloadinterface.IMetadata, resourcesIDs *reporthandling.ResourcesIDs, frameworkName, controlName string) {
+	printer.printDetails(allResources, resourcesIDs.GetFailedResources(), frameworkName, controlName, "failed")
+	printer.printDetails(allResources, resourcesIDs.GetWarningResources(), frameworkName, controlName, "excluded")
+	if printer.verboseMode {
+		printer.printDetails(allResources, resourcesIDs.GetPassedResources(), frameworkName, controlName, "passed")
+	}
+
+}
+func (printer *PrometheusPrinter) printDetails(allResources map[string]workloadinterface.IMetadata, resourcesIDs []string, frameworkName, controlName, status string) {
+	objs := make(map[string]map[string]map[string]int)
+	for _, resourceID := range resourcesIDs {
+		resource := allResources[resourceID]
+
+		gvk := fmt.Sprintf("%s/%s", resource.GetApiVersion(), resource.GetKind())
+
+		if objs[gvk] == nil {
+			objs[gvk] = make(map[string]map[string]int)
+		}
+		if objs[gvk][resource.GetNamespace()] == nil {
+			objs[gvk][resource.GetNamespace()] = make(map[string]int)
+		}
+		objs[gvk][resource.GetNamespace()][resource.GetName()]++
+	}
+	for gvk, namespaces := range objs {
+		for namespace, names := range namespaces {
+			for name, value := range names {
+				fmt.Fprintf(printer.writer, "# Failed object from \"%s\" control \"%s\"\n", frameworkName, controlName)
+				if namespace != "" {
+					fmt.Fprintf(printer.writer, "kubescape_object_failed_count{framework=\"%s\",control=\"%s\",namespace=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", frameworkName, controlName, namespace, name, gvk, value)
+				} else {
+					fmt.Fprintf(printer.writer, "kubescape_object_failed_count{framework=\"%s\",control=\"%s\",name=\"%s\",groupVersionKind=\"%s\"} %d\n", frameworkName, controlName, name, gvk, value)
+				}
+			}
+		}
+	}
+}
+
+func (printer *PrometheusPrinter) printReports(allResources map[string]workloadinterface.IMetadata, frameworks []reporthandling.FrameworkReport) error {
+	for _, frameworkReport := range frameworks {
+		for _, controlReport := range frameworkReport.ControlReports {
+			if controlReport.GetNumberOfResources() == 0 {
+				continue // the control did not test any resources
+			}
+			if controlReport.Passed() {
+				continue // control passed, do not print results
+			}
+			fmt.Fprintf(printer.writer, "# Number of resources found as part of %s control %s\nkubescape_resources_found_count{framework=\"%s\",control=\"%s\"} %d\n", frameworkReport.Name, controlReport.Name, frameworkReport.Name, controlReport.Name, controlReport.GetNumberOfResources())
+			fmt.Fprintf(printer.writer, "# Number of resources excluded as part of %s control %s\nkubescape_resources_excluded_count{framework=\"%s\",control=\"%s\"} %d\n", frameworkReport.Name, controlReport.Name, frameworkReport.Name, controlReport.Name, controlReport.GetNumberOfWarningResources())
+			fmt.Fprintf(printer.writer, "# Number of resources failed as part of %s control %s\nkubescape_resources_failed_count{framework=\"%s\",control=\"%s\"} %d\n", frameworkReport.Name, controlReport.Name, frameworkReport.Name, controlReport.Name, controlReport.GetNumberOfFailedResources())
+
+			printer.printResources(allResources, controlReport.ListResourcesIDs(), frameworkReport.Name, controlReport.Name)
+		}
+	}
+	return nil
+}
+
+func (printer *PrometheusPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
+	err := printer.printReports(opaSessionObj.AllResources, opaSessionObj.PostureReport.FrameworkReports)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}
--- a/resultshandling/printer/silentprinter.go
+++ b/resultshandling/printer/silentprinter.go
@@ -0,0 +1,11 @@
+package printer
+
+import (
+	"github.com/armosec/kubescape/cautils"
+)
+
+type SilentPrinter struct {
+}
+
+func (silentPrinter *SilentPrinter) ActionPrint(opaSessionObj *cautils.OPASessionObj) {
+}
--- a/resultshandling/printer/summary.go
+++ b/resultshandling/printer/summary.go
@@ -3,50 +3,52 @@ package printer
 import (
 	"fmt"

-	"github.com/armosec/armoapi-go/armotypes"
+	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/opa-utils/reporthandling"
 )

-type Summary map[string]ControlSummary
+type Summary map[string]ResultSummary

 func NewSummary() Summary {
-	return make(map[string]ControlSummary)
+	return make(map[string]ResultSummary)
 }

-type ControlSummary struct {
+type ResultSummary struct {
+	ID                string
+	RiskScore         float32
 	TotalResources    int
 	TotalFailed       int
-	TotalWarnign      int
+	TotalWarning      int
 	Description       string
 	Remediation       string
+	Framework         []string
 	ListInputKinds    []string
 	FailedWorkloads   map[string][]WorkloadSummary // <namespace>:[<WorkloadSummary>]
 	ExcludedWorkloads map[string][]WorkloadSummary // <namespace>:[<WorkloadSummary>]
+	PassedWorkloads   map[string][]WorkloadSummary // <namespace>:[<WorkloadSummary>]
 }

 type WorkloadSummary struct {
-	Kind      string
-	Name      string
-	Namespace string
-	Group     string
-	Exception *armotypes.PostureExceptionPolicy
+	resource workloadinterface.IMetadata
+	status   string
 }

-func (controlSummary *ControlSummary) ToSlice() []string {
+func (controlSummary *ResultSummary) ToSlice() []string {
 	s := []string{}
 	s = append(s, fmt.Sprintf("%d", controlSummary.TotalFailed))
-	s = append(s, fmt.Sprintf("%d", controlSummary.TotalWarnign))
+	s = append(s, fmt.Sprintf("%d", controlSummary.TotalWarning))
 	s = append(s, fmt.Sprintf("%d", controlSummary.TotalResources))
 	return s
 }

-func (workloadSummary *WorkloadSummary) ToString() string {
-	return fmt.Sprintf("/%s/%s/%s/%s", workloadSummary.Group, workloadSummary.Namespace, workloadSummary.Kind, workloadSummary.Name)
-}
-
 func workloadSummaryFailed(workloadSummary *WorkloadSummary) bool {
-	return workloadSummary.Exception == nil
+	return workloadSummary.status == reporthandling.StatusFailed
 }

 func workloadSummaryExclude(workloadSummary *WorkloadSummary) bool {
-	return workloadSummary.Exception != nil && workloadSummary.Exception.IsAlertOnly()
+	return workloadSummary.status == reporthandling.StatusWarning
+}
+
+func workloadSummaryPassed(workloadSummary *WorkloadSummary) bool {
+	return workloadSummary.status == reporthandling.StatusPassed
 }
--- a/resultshandling/printer/summeryhelpers.go
+++ b/resultshandling/printer/summeryhelpers.go
@@ -1,75 +1,85 @@
 package printer

 import (
-	"fmt"
-
+	"github.com/armosec/k8s-interface/k8sinterface"
 	"github.com/armosec/k8s-interface/workloadinterface"
+	"github.com/armosec/opa-utils/objectsenvelopes"
 	"github.com/armosec/opa-utils/reporthandling"
 )

 // Group workloads by namespace - return {"namespace": <[]WorkloadSummary>}
-func groupByNamespace(resources []WorkloadSummary, status func(workloadSummary *WorkloadSummary) bool) map[string][]WorkloadSummary {
+func groupByNamespaceOrKind(resources []WorkloadSummary, status func(workloadSummary *WorkloadSummary) bool) map[string][]WorkloadSummary {
 	mapResources := make(map[string][]WorkloadSummary)
 	for i := range resources {
-		if status(&resources[i]) {
-			if r, ok := mapResources[resources[i].Namespace]; ok {
+		if !status(&resources[i]) {
+			continue
+		}
+		t := resources[i].resource.GetObjectType()
+		if t == objectsenvelopes.TypeRegoResponseVectorObject && !isKindToBeGrouped(resources[i].resource.GetKind()) {
+			t = workloadinterface.TypeWorkloadObject
+		}
+		switch t { // TODO - find a better way to defind the groups
+		case workloadinterface.TypeWorkloadObject:
+			ns := ""
+			if resources[i].resource.GetNamespace() != "" {
+				ns = "Namescape " + resources[i].resource.GetNamespace()
+			}
+			if r, ok := mapResources[ns]; ok {
 				r = append(r, resources[i])
-				mapResources[resources[i].Namespace] = r
+				mapResources[ns] = r
 			} else {
-				mapResources[resources[i].Namespace] = []WorkloadSummary{resources[i]}
+				mapResources[ns] = []WorkloadSummary{resources[i]}
+			}
+		case objectsenvelopes.TypeRegoResponseVectorObject:
+			group := resources[i].resource.GetKind() + "s"
+			if r, ok := mapResources[group]; ok {
+				r = append(r, resources[i])
+				mapResources[group] = r
+			} else {
+				mapResources[group] = []WorkloadSummary{resources[i]}
+			}
+		default:
+			group, _ := k8sinterface.SplitApiVersion(resources[i].resource.GetApiVersion())
+			if r, ok := mapResources[group]; ok {
+				r = append(r, resources[i])
+				mapResources[group] = r
+			} else {
+				mapResources[group] = []WorkloadSummary{resources[i]}
 			}
 		}
 	}
 	return mapResources
 }
-func listResultSummary(ruleReports []reporthandling.RuleReport) []WorkloadSummary {
+
+func isKindToBeGrouped(kind string) bool {
+	if kind == "Group" || kind == "User" {
+		return true
+	}
+	return false
+}
+
+func listResultSummary(ruleReports []reporthandling.RuleReport, allResources map[string]workloadinterface.IMetadata) []WorkloadSummary {
 	workloadsSummary := []WorkloadSummary{}
-	track := map[string]bool{}

 	for c := range ruleReports {
-		for _, ruleReport := range ruleReports[c].RuleResponses {
-			resource, err := ruleResultSummary(ruleReport.AlertObject)
-			if err != nil {
-				fmt.Println(err.Error())
-				continue
-			}
+		resourcesIDs := ruleReports[c].ListResourcesIDs()
+		workloadsSummary = append(workloadsSummary, newListWorkloadsSummary(allResources, resourcesIDs.GetFailedResources(), reporthandling.StatusFailed)...)
+		workloadsSummary = append(workloadsSummary, newListWorkloadsSummary(allResources, resourcesIDs.GetWarningResources(), reporthandling.StatusWarning)...)
+		workloadsSummary = append(workloadsSummary, newListWorkloadsSummary(allResources, resourcesIDs.GetPassedResources(), reporthandling.StatusPassed)...)
+	}
+	return workloadsSummary
+}

-			// add resource only once
-			for i := range resource {
-				resource[i].Exception = ruleReport.Exception
-				if ok := track[resource[i].ToString()]; !ok {
-					track[resource[i].ToString()] = true
-					workloadsSummary = append(workloadsSummary, resource[i])
-				}
-			}
+func newListWorkloadsSummary(allResources map[string]workloadinterface.IMetadata, resourcesIDs []string, status string) []WorkloadSummary {
+	workloadsSummary := []WorkloadSummary{}
+
+	for _, i := range resourcesIDs {
+		if r, ok := allResources[i]; ok {
+			workloadsSummary = append(workloadsSummary, WorkloadSummary{
+				resource: r,
+				status:   status,
+			})
 		}
 	}
 	return workloadsSummary
 }
-func ruleResultSummary(obj reporthandling.AlertObject) ([]WorkloadSummary, error) {
-	resource := []WorkloadSummary{}
-
-	for i := range obj.K8SApiObjects {
-		r, err := newWorkloadSummary(obj.K8SApiObjects[i])
-		if err != nil {
-			return resource, err
-		}
-
-		resource = append(resource, *r)
-	}
-
-	return resource, nil
-}
-
-func newWorkloadSummary(obj map[string]interface{}) (*WorkloadSummary, error) {
-	r := &WorkloadSummary{}
-
-	workload := workloadinterface.NewWorkloadObj(obj)
-	if workload == nil {
-		return r, fmt.Errorf("expecting k8s API object")
-	}
-	r.Kind = workload.GetKind()
-	r.Namespace = workload.GetNamespace()
-	r.Name = workload.GetName()
-	return r, nil
-}
--- a/resultshandling/reporter/mockreporter.go
+++ b/resultshandling/reporter/mockreporter.go
@@ -0,0 +1,30 @@
+package reporter
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
+)
+
+type ReportMock struct {
+}
+
+func NewReportMock() *ReportMock {
+	return &ReportMock{}
+}
+func (reportMock *ReportMock) ActionSendReport(opaSessionObj *cautils.OPASessionObj) error {
+	return nil
+}
+
+func (reportMock *ReportMock) SetCustomerGUID(customerGUID string) {
+}
+
+func (reportMock *ReportMock) SetClusterName(clusterName string) {
+}
+
+func (reportMock *ReportMock) DisplayReportURL() {
+	message := fmt.Sprintf("\nYou can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more by registering here: https://%s/cli-signup \n", getter.GetArmoAPIConnector().GetFrontendURL())
+	cautils.InfoTextDisplay(os.Stdout, fmt.Sprintf("\n%s\n", message))
+}
--- a/resultshandling/reporter/reporteventreceiver.go
+++ b/resultshandling/reporter/reporteventreceiver.go
@@ -1,63 +1,139 @@
 package reporter

 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/url"
+	"os"

+	"github.com/armosec/k8s-interface/workloadinterface"
 	"github.com/armosec/kubescape/cautils"
+	"github.com/armosec/kubescape/cautils/getter"
 	"github.com/armosec/opa-utils/reporthandling"
 )

+const MAX_REPORT_SIZE = 2097152 // 2 MB
+
+type IReport interface {
+	ActionSendReport(opaSessionObj *cautils.OPASessionObj) error
+	SetCustomerGUID(customerGUID string)
+	SetClusterName(clusterName string)
+	DisplayReportURL()
+}
+
 type ReportEventReceiver struct {
-	httpClient http.Client
-	host       url.URL
+	httpClient         *http.Client
+	clusterName        string
+	customerGUID       string
+	eventReceiverURL   *url.URL
+	token              string
+	customerAdminEMail string
 }

-func NewReportEventReceiver() *ReportEventReceiver {
-	hostURL := initEventReceiverURL()
+func NewReportEventReceiver(tenantConfig *cautils.ConfigObj) *ReportEventReceiver {
 	return &ReportEventReceiver{
-		httpClient: http.Client{},
-		host:       *hostURL,
+		httpClient:         &http.Client{},
+		clusterName:        tenantConfig.ClusterName,
+		customerGUID:       tenantConfig.CustomerGUID,
+		token:              tenantConfig.Token,
+		customerAdminEMail: tenantConfig.CustomerAdminEMail,
 	}
 }

-func (report *ReportEventReceiver) ActionSendReportListenner(opaSessionObj *cautils.OPASessionObj) {
-	if cautils.CustomerGUID == "" {
-		return
-	}
-	//Add score
+func (report *ReportEventReceiver) ActionSendReport(opaSessionObj *cautils.OPASessionObj) error {

-	// Remove data before reporting
-	keepFields := []string{"kind", "apiVersion", "metadata"}
-	keepMetadataFields := []string{"name", "namespace", "labels"}
-	opaSessionObj.PostureReport.RemoveData(keepFields, keepMetadataFields)
-
-	if err := report.Send(opaSessionObj.PostureReport); err != nil {
-		fmt.Println(err)
+	if err := report.prepareReport(opaSessionObj.PostureReport, opaSessionObj.AllResources); err != nil {
+		return err
 	}
+	return nil
 }
-func (report *ReportEventReceiver) Send(postureReport *reporthandling.PostureReport) error {

-	reqBody, err := json.Marshal(*postureReport)
-	if err != nil {
-		return fmt.Errorf("in 'Send' failed to json.Marshal, reason: %v", err)
-	}
-	host := hostToString(&report.host, postureReport.ReportID)
+func (report *ReportEventReceiver) SetCustomerGUID(customerGUID string) {
+	report.customerGUID = customerGUID
+}

-	req, err := http.NewRequest("POST", host, bytes.NewReader(reqBody))
-	if err != nil {
-		return fmt.Errorf("in 'Send', http.NewRequest failed, host: %s, reason: %v", host, err)
+func (report *ReportEventReceiver) SetClusterName(clusterName string) {
+	report.clusterName = clusterName
+}
+
+func (report *ReportEventReceiver) prepareReport(postureReport *reporthandling.PostureReport, allResources map[string]workloadinterface.IMetadata) error {
+	report.initEventReceiverURL()
+	host := hostToString(report.eventReceiverURL, postureReport.ReportID)
+
+	cautils.StartSpinner()
+	defer cautils.StopSpinner()
+
+	// send framework results
+	if err := report.sendReport(host, postureReport); err != nil {
+		return err
 	}
-	res, err := report.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("httpClient.Do failed: %v", err)
+
+	// send resources
+	if err := report.sendResources(host, postureReport, allResources); err != nil {
+		return err
 	}
-	msg, err := httpRespToString(res)
+	return nil
+}
+
+func (report *ReportEventReceiver) sendResources(host string, postureReport *reporthandling.PostureReport, allResources map[string]workloadinterface.IMetadata) error {
+	splittedPostureReport := setPaginationReport(postureReport)
+	counter := 0
+
+	for _, v := range allResources {
+		r, err := json.Marshal(*iMetaToResource(v))
+		if err != nil {
+			return fmt.Errorf("failed to unmarshal resource '%s', reason: %v", v.GetID(), err)
+		}
+
+		if counter+len(r) >= MAX_REPORT_SIZE && len(splittedPostureReport.Resources) > 0 {
+
+			// send report
+			if err := report.sendReport(host, splittedPostureReport); err != nil {
+				return err
+			}
+
+			// delete resources
+			splittedPostureReport.Resources = []reporthandling.Resource{}
+
+			// restart counter
+			counter = 0
+		}
+
+		counter += len(r)
+		splittedPostureReport.Resources = append(splittedPostureReport.Resources, *iMetaToResource(v))
+	}
+
+	return report.sendReport(host, splittedPostureReport)
+}
+func (report *ReportEventReceiver) sendReport(host string, postureReport *reporthandling.PostureReport) error {
+	reqBody, err := json.Marshal(postureReport)
+	if err != nil {
+		return fmt.Errorf("in 'sendReport' failed to json.Marshal, reason: %v", err)
+	}
+	msg, err := getter.HttpPost(report.httpClient, host, nil, reqBody)
 	if err != nil {
 		return fmt.Errorf("%s, %v:%s", host, err, msg)
 	}
 	return err
 }
+
+func (report *ReportEventReceiver) DisplayReportURL() {
+	message := "You can see the results in a user-friendly UI, choose your preferred compliance framework, check risk results history and trends, manage exceptions, get remediation recommendations and much more by registering here:"
+
+	u := url.URL{}
+	u.Scheme = "https"
+	u.Host = getter.GetArmoAPIConnector().GetFrontendURL()
+
+	if report.customerAdminEMail != "" {
+		cautils.InfoTextDisplay(os.Stdout, fmt.Sprintf("\n\n%s %s/risk/%s\n(Account: %s)\n\n", message, u.String(), report.clusterName, report.customerGUID))
+		return
+	}
+	u.Path = "account/sign-up"
+	q := u.Query()
+	q.Add("invitationToken", report.token)
+	q.Add("customerGUID", report.customerGUID)
+
+	u.RawQuery = q.Encode()
+	cautils.InfoTextDisplay(os.Stdout, fmt.Sprintf("\n\n%s %s\n\n", message, u.String()))
+}
--- a/Show More
+++ b/Show More