The annotation was added after scan: Annotations: images.openshift.io/deny-execution=true security.manageiq.org/failed-policy=openscap policy