// Module included in the following assemblies:
//
// * security/compliance_operator/co-scans/compliance-operator-checkresult-custom-metadata.adoc

:_mod-docs-content-type: CONCEPT
[id="compliance-operator-checkresult-custom-metadata-overview_{context}"]
= Understanding custom metadata on rules and check results

[role="_abstract"]
When the Compliance Operator creates or updates a `ComplianceCheckResult` object for a check that Open Security Content Automation Protocol (OpenSCAP) evaluates, it copies custom labels and annotations from the corresponding `Rule` object in the same namespace.

For checks that the Common Expression Language (CEL) scanner evaluates from a `CustomRule`, the Operator copies custom metadata from that `CustomRule` instead.

Custom metadata is any label or annotation whose name is not managed by the Compliance Operator or core Kubernetes namespaces. Some keys are reserved, so user-supplied values never replace the Operator values for those keys. Examples include the following:

* Keys starting with `compliance.openshift.io/`
* Keys starting with `complianceoperator.openshift.io/`
* Keys starting with `complianceascode.io/`
* Keys where the domain contains `kubernetes.io/` (such as `kubernetes.io/name` or `app.kubernetes.io/`)
* Keys where the domain contains `k8s.io/` (such as `k8s.io/component` or `node.k8s.io/instance-type`)

[NOTE]
====
Metadata that you set on `TailoredProfile`, `ScanSettingBinding`, or other orchestration resources is not propagated to individual `ComplianceCheckResult` objects. Attach metadata on the `Rule` or `CustomRule` that owns the check.
====

[NOTE]
====
Custom metadata on `ComplianceRemediation` objects is not covered by this feature.
====

Profile bundle updates:: When a `ProfileBundle` refreshes profile content, the Operator merges user-defined annotations on `Rule` objects with parser-managed annotations so your keys remain while Operator and content fields stay current.

Failure behavior:: If the Operator cannot build its in-memory index of `Rule` objects during aggregation, it logs a warning and still creates scan results without your custom metadata. If a label value violates Kubernetes length or syntax rules, the Operator can fail to create that specific `ComplianceCheckResult` while other results continue.

For more background on the enhancement, see Additional resources.
