core-landing-zone:0.7.1 fails on 12 services (log sink, dns service enable, dependent

review 0.7.0 issue in dec https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/752

Follow after initial kpt render fails on 12 resources after core-landing-zone deploy in #766

the issue is likely missing IAM permissions on clean account cloud-setup.org - where an older org that even had an older hub-env is ok obrien.industries below

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/DevOps#continue-kpt-fn-render-after-failed-services-fixed

```
echo "kpt live init"
#kpt live init $REL_SUB_PACKAGE --namespace config-control --force
echo "kpt fn render"
kpt fn render $REL_SUB_PACKAGE --truncate-output=false
#kpt alpha live plan $REL_SUB_PACKAGE
echo "kpt live apply"
# without a timeout the command never terminates
kpt live apply $REL_SUB_PACKAGE --reconcile-timeout=10m

michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubens config-control
Context "gke_kcc-cso-4380_northamerica-northeast1_krmapihost-kcc" modified.
Active namespace is "config-control".
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp | grep UpdateFailed | wc -l
0
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp
NAME AGE READY STATUS STATUS AGE
iamserviceaccount.iam.cnrm.cloud.google.com/config-mgmt-mon-default-sa 25m True UpToDate 25m
iamserviceaccount.iam.cnrm.cloud.google.com/gatekeeper-admin-sa 25m True UpToDate 25m
iamserviceaccount.iam.cnrm.cloud.google.com/hierarchy-sa 25m True UpToDate 25m
iamserviceaccount.iam.cnrm.cloud.google.com/logging-sa 25m True UpToDate 25m
iamserviceaccount.iam.cnrm.cloud.google.com/networking-sa 25m True UpToDate 25m
iamserviceaccount.iam.cnrm.cloud.google.com/policies-sa 25m True UpToDate 25m
iamserviceaccount.iam.cnrm.cloud.google.com/projects-sa 25m True UpToDate 25m

NAME AGE READY STATUS STATUS AGE
iampartialpolicy.iam.cnrm.cloud.google.com/config-mgmt-mon-default-sa-workload-identity-binding 25m True UpToDate 25m
iampartialpolicy.iam.cnrm.cloud.google.com/gatekeeper-admin-sa-workload-identity-binding 25m True UpToDate 25m
iampartialpolicy.iam.cnrm.cloud.google.com/hierarchy-sa-workload-identity-binding 25m True UpToDate 25m
iampartialpolicy.iam.cnrm.cloud.google.com/logging-sa-workload-identity-binding 25m True UpToDate 25m
iampartialpolicy.iam.cnrm.cloud.google.com/networking-sa-workload-identity-binding 25m True UpToDate 25m
iampartialpolicy.iam.cnrm.cloud.google.com/policies-sa-workload-identity-binding 25m True UpToDate 25m
iampartialpolicy.iam.cnrm.cloud.google.com/projects-sa-workload-identity-binding 25m True UpToDate 25m

NAME AGE READY STATUS STATUS AGE
iamcustomrole.iam.cnrm.cloud.google.com/gke-firewall-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier2-dnsrecord-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier2-vpcpeering-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-dnsrecord-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-firewallrule-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-subnetwork-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier3-vpcsc-admin 25m True UpToDate 25m
iamcustomrole.iam.cnrm.cloud.google.com/tier4-secretmanager-admin 25m True UpToDate 25m

NAME AGE READY STATUS STATUS AGE
iampolicymember.iam.cnrm.cloud.google.com/config-control-sa-management-project-editor-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/config-control-sa-management-project-serviceaccountadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/config-control-sa-orgroleadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/config-mgmt-mon-default-sa-metric-writer-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/gatekeeper-admin-sa-metric-writer-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/hierarchy-sa-folderadmin-permissions 25m True UpToDate 24m
iampolicymember.iam.cnrm.cloud.google.com/logging-sa-logadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/logging-sa-monitoring-admin-kcc-cso-4380-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-dns-permissions 25m True UpToDate 24m
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-networkadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-security-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-service-control-org-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-servicedirectoryeditor-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/networking-sa-xpnadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/policies-sa-orgpolicyadmin-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-billinguser-permissions 25m True UpToDate 25m
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectcreator-permissions 25m True UpToDate 24m
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectdeleter-permissions 25m True UpToDate 24m
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectiamadmin-permissions 25m True UpToDate 24m
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-projectmover-permissions 25m True UpToDate 24m
iampolicymember.iam.cnrm.cloud.google.com/projects-sa-serviceusageadmin-permissions 25m True UpToDate 24m

NAME AGE READY STATUS STATUS AGE
service.serviceusage.cnrm.cloud.google.com/kcc-cso-4380-accesscontextmanager 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-cso-4380-anthos 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-cso-4380-cloudbilling 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-cso-4380-cloudresourcemanager 25m True UpToDate 25m
service.serviceusage.cnrm.cloud.google.com/kcc-cso-4380-serviceusage 25m True UpToDate 25m

michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp -n projects
NAME AGE READY STATUS STATUS AGE
iampartialpolicy.iam.cnrm.cloud.google.com/mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions 19m False DependencyNotFound 19m
iampartialpolicy.iam.cnrm.cloud.google.com/platform-and-component-services-infra-log-bucket-writer-permissions 19m False DependencyNotFound 19m
iampartialpolicy.iam.cnrm.cloud.google.com/platform-and-component-services-log-bucket-writer-permissions 19m False DependencyNotFound 19m
iampartialpolicy.iam.cnrm.cloud.google.com/security-log-bucket-writer-permissions 19m False DependencyNotFound 19m

NAME AGE READY STATUS STATUS AGE
iampolicymember.iam.cnrm.cloud.google.com/logging-sa-monitoring-admin-logging-project-cso1-permissions 25m True UpToDate 22m
iampolicymember.iam.cnrm.cloud.google.com/logging-sa-storageadmin-logging-project-cso1-permissions 25m True UpToDate 19m

NAME AGE READY STATUS STATUS AGE
iamauditconfig.iam.cnrm.cloud.google.com/logging-project-data-access-log-config 19m True UpToDate 19m

NAME AGE READY STATUS STATUS AGE
project.resourcemanager.cnrm.cloud.google.com/dns-project-cso1 19m True UpToDate 15m
project.resourcemanager.cnrm.cloud.google.com/logging-project-cso1 25m True UpToDate 19m

NAME AGE READY STATUS STATUS AGE
service.serviceusage.cnrm.cloud.google.com/logging-project-cso1-logging 19m True UpToDate 19m
service.serviceusage.cnrm.cloud.google.com/logging-project-cso1-monitoring 19m True UpToDate 19m
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp -n networking
No resources found in networking namespace.
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp -n hierarchy
NAME AGE READY STATUS STATUS AGE
folder.resourcemanager.cnrm.cloud.google.com/audits 26m True UpToDate 25m
folder.resourcemanager.cnrm.cloud.google.com/clients 26m True UpToDate 25m
folder.resourcemanager.cnrm.cloud.google.com/services 26m True UpToDate 25m
folder.resourcemanager.cnrm.cloud.google.com/services-infrastructure 26m True UpToDate 25m
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp -n policies
NAME AGE READY STATUS STATUS AGE
resourcemanagerpolicy.resourcemanager.cnrm.cloud.google.com/compute-disable-serial-port-logging-except-kcc-cso-4380 26m True UpToDate 24m
resourcemanagerpolicy.resourcemanager.cnrm.cloud.google.com/compute-require-shielded-vm-except-kcc-cso-4380 26m True UpToDate 24m
resourcemanagerpolicy.resourcemanager.cnrm.cloud.google.com/compute-restrict-cloud-nat-usage-except-kcc-cso-4380 26m True UpToDate 24m
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp -n logging
NAME AGE READY STATUS STATUS AGE
logginglogbucket.logging.cnrm.cloud.google.com/platform-and-component-log-bucket-cso1 20m True UpToDate 20m
logginglogbucket.logging.cnrm.cloud.google.com/security-log-bucket 20m True UpToDate 20m

NAME AGE READY STATUS STATUS AGE
monitoringmonitoredproject.monitoring.cnrm.cloud.google.com/kcc-cso-4380 26m True UpToDate 20m

NAME AGE READY STATUS STATUS AGE
storagebucket.storage.cnrm.cloud.google.com/security-incident-log-bucket 20m True UpToDate 20m

```

Issues with missing networking namespace artifacts and permissions on projects
```
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl get gcp -n projects
NAME AGE READY STATUS STATUS AGE
iampartialpolicy.iam.cnrm.cloud.google.com/mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions 19m False DependencyNotFound 19m
iampartialpolicy.iam.cnrm.cloud.google.com/platform-and-component-services-infra-log-bucket-writer-permissions 19m False DependencyNotFound 19m
iampartialpolicy.iam.cnrm.cloud.google.com/platform-and-component-services-log-bucket-writer-permissions 19m False DependencyNotFound 19m
iampartialpolicy.iam.cnrm.cloud.google.com/security-log-bucket-writer-permissions 19m False DependencyNotFound 19m

michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kubectl describe iampartialpolicy.iam.cnrm.cloud.google.com/mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions -n projects

Warning DependencyNotFound 4m15s (x3 over 23m) iampartialpolicy-controller reference LoggingLogSink logging/mgmt-project-cluster-platform-and-component-log-sink is not found

mgmt-project/project-sink.yaml
spec:
projectRef:
external: kcc-cso-4380 # kpt-set: ${management-project-id}
destination:
# AU-3, AU-3(1), AU-4(1), AU-6(4), AU-9(2)
loggingLogBucketRef:
external: logging.googleapis.com/projects/logging-project-cso1/locations/northamerica-northeast1/buckets/platform-and-component-log-bucket-cso1 # kpt-set: logging.googleapis.com/projects/${logging-project-id}/locations/northamerica-northeast1/buckets/${platform-and-component-log-bucket}

checking
looks like the name is not rendered correctly - missing cso1
logginglogbucket.logging.cnrm.cloud.google.com/platform-and-component-log-bucket-cso1 apply successful
from setters.yaml
platform-and-component-log-bucket: platform-and-component-log-bucket-cso1

check sa
kubectl describe iamserviceaccount.iam.cnrm.cloud.google.com/projects-sa
Normal UpToDate 40m (x2 over 40m) iamserviceaccount-controller The resource is up to date

don't need to do
gcloud beta billing accounts add-iam-policy-binding "${BILLING_ID}" --member "serviceAccount:projects-sa@${KCC_PROJECT_ID}.iam.gserviceaccount.com" --role "roles/billing.user"
```

DNS managed zone is missing because of service permission on dns.googleapis.com

```
## triage skipped resources on pass 1
```
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kpt live status core-landing-zone
inventory-49821483/folder.resourcemanager.cnrm.cloud.google.com/hierarchy/audits is Current: Resource is Current
inventory-49821483/logginglogbucket.logging.cnrm.cloud.google.com/logging/security-log-bucket is Current: Resource is Current
inventory-49821483/logginglogbucket.logging.cnrm.cloud.google.com/logging/platform-and-component-log-bucket-cso1 is Current: Resource is Current
inventory-49821483/storagebucket.storage.cnrm.cloud.google.com/logging/security-incident-log-bucket is Current: Resource is Current
inventory-49821483/monitoringmonitoredproject.monitoring.cnrm.cloud.google.com/logging/kcc-cso-4380 is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/security-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/org-log-sink-security-logging-project-cso1 is not found
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/platform-and-component-services-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/platform-and-component-services-log-sink is not found
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/platform-and-component-services-infra-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/platform-and-component-services-infra-log-sink is not found
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/mgmt-project-cluster-platform-and-component-log-sink is not found
inventory-49821483/iamauditconfig.iam.cnrm.cloud.google.com/projects/logging-project-data-access-log-config is Current: Resource is Current
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/logging-project-cso1-data-access-sink is NotFound: Resource not found
inventory-49821483/project.resourcemanager.cnrm.cloud.google.com/projects/logging-project-cso1 is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/projects/logging-project-cso1-logging is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/projects/logging-project-cso1-monitoring is Current: Resource is Current
inventory-49821483/folder.resourcemanager.cnrm.cloud.google.com/hierarchy/clients is Current: Resource is Current
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/platform-and-component-services-log-sink is NotFound: Resource not found
inventory-49821483/folder.resourcemanager.cnrm.cloud.google.com/hierarchy/services is Current: Resource is Current
inventory-49821483/dnsmanagedzone.dns.cnrm.cloud.google.com/networking/dns-project-cso1-standard-core-public-dns is NotFound: Resource not found
inventory-49821483/project.resourcemanager.cnrm.cloud.google.com/projects/dns-project-cso1 is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/projects/dns-project-cso1-dns is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/platform-and-component-services-infra-log-sink is NotFound: Resource not found
inventory-49821483/folder.resourcemanager.cnrm.cloud.google.com/hierarchy/services-infrastructure is Current: Resource is Current
inventory-49821483/resourcemanagerpolicy.resourcemanager.cnrm.cloud.google.com/policies/compute-disable-serial-port-logging-except-kcc-cso-4380 is Current: Resource is Current
inventory-49821483/resourcemanagerpolicy.resourcemanager.cnrm.cloud.google.com/policies/compute-require-shielded-vm-except-kcc-cso-4380 is Current: Resource is Current
inventory-49821483/resourcemanagerpolicy.resourcemanager.cnrm.cloud.google.com/policies/compute-restrict-cloud-nat-usage-except-kcc-cso-4380 is Current: Resource is Current
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/mgmt-project-cluster-platform-and-component-log-sink is NotFound: Resource not found
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/config-control/kcc-cso-4380-cloudbilling is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/config-control/kcc-cso-4380-cloudresourcemanager is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/config-control/kcc-cso-4380-serviceusage is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/config-control/kcc-cso-4380-accesscontextmanager is Current: Resource is Current
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/config-control/kcc-cso-4380-anthos is Current: Resource is Current
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/config-mgmt-mon-default-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/config-mgmt-mon-default-sa-metric-writer-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/config-mgmt-mon-default-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/config-management-monitoring/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/gatekeeper-admin-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/gatekeeper-admin-sa-metric-writer-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/gatekeeper-admin-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/gatekeeper-system/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/hierarchy-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/hierarchy-sa-folderadmin-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/hierarchy-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/namespace//hierarchy is Current: Resource is current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/hierarchy/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/rolebinding.rbac.authorization.k8s.io/hierarchy/allow-hierarchy-resource-reference-from-projects is Current: Resource is current
inventory-49821483/rolebinding.rbac.authorization.k8s.io/hierarchy/allow-hierarchy-resource-reference-from-policies is Current: Resource is current
inventory-49821483/rolebinding.rbac.authorization.k8s.io/hierarchy/allow-hierarchy-resource-reference-from-config-control is Current: Resource is current
inventory-49821483/rolebinding.rbac.authorization.k8s.io/hierarchy/allow-folders-resource-reference-to-logging is Current: Resource is current
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/logging-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/logging-sa-logadmin-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/logging-sa-monitoring-admin-kcc-cso-4380-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/projects/logging-sa-monitoring-admin-logging-project-cso1-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/projects/logging-sa-storageadmin-logging-project-cso1-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/logging-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/namespace//logging is Current: Resource is current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/logging/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/rolebinding.rbac.authorization.k8s.io/logging/allow-logging-resource-reference-from-projects is Current: Resource is current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/config-control-sa-orgroleadmin-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/config-control-sa-management-project-editor-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/config-control-sa-management-project-serviceaccountadmin-permissions is Current: Resource is Current
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/networking-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/networking-sa-networkadmin-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/networking-sa-security-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/networking-sa-dns-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/networking-sa-service-control-org-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/networking-sa-xpnadmin-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/networking-sa-servicedirectoryeditor-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/networking-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/namespace//networking is Current: Resource is current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/networking/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/policies-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/policies-sa-orgpolicyadmin-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/policies-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/namespace//policies is Current: Resource is current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/policies/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/iamserviceaccount.iam.cnrm.cloud.google.com/config-control/projects-sa is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/projects-sa-projectiamadmin-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/projects-sa-projectcreator-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/projects-sa-projectmover-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/projects-sa-projectdeleter-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/projects-sa-serviceusageadmin-permissions is Current: Resource is Current
inventory-49821483/iampolicymember.iam.cnrm.cloud.google.com/config-control/projects-sa-billinguser-permissions is Current: Resource is Current
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/config-control/projects-sa-workload-identity-binding is Current: Resource is Current
inventory-49821483/namespace//projects is Current: Resource is current
inventory-49821483/configconnectorcontext.core.cnrm.cloud.google.com/projects/configconnectorcontext.core.cnrm.cloud.google.com is Current: status.healthy is true
inventory-49821483/rolebinding.rbac.authorization.k8s.io/projects/allow-projects-resource-reference-from-logging is Current: Resource is current
inventory-49821483/rolebinding.rbac.authorization.k8s.io/projects/allow-projects-resource-reference-from-networking is Current: Resource is current
inventory-49821483/rolebinding.rbac.authorization.k8s.io/projects/allow-projects-resource-reference-from-policies is Current: Resource is current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/gke-firewall-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier2-dnsrecord-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier2-vpcpeering-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier3-dnsrecord-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier3-firewallrule-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier3-subnetwork-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier3-vpcsc-admin is Current: Resource is Current
inventory-49821483/iamcustomrole.iam.cnrm.cloud.google.com/config-control/tier4-secretmanager-admin is Current: Resource is Current
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/org-log-sink-security-logging-project-cso1 is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/org-log-sink-data-access-logging-project-cso1 is NotFound: Resource not found
```

missing 12
```
michael@cloudshell:~/kcc-cso/kpt (kcc-cso-4380)$ kpt live status core-landing-zone | grep not
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/security-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/org-log-sink-security-logging-project-cso1 is not found
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/platform-and-component-services-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/platform-and-component-services-log-sink is not found
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/platform-and-component-services-infra-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/platform-and-component-services-infra-log-sink is not found
inventory-49821483/iampartialpolicy.iam.cnrm.cloud.google.com/projects/mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions is InProgress: reference LoggingLogSink logging/mgmt-project-cluster-platform-and-component-log-sink is not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/logging-project-cso1-data-access-sink is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/platform-and-component-services-log-sink is NotFound: Resource not found
inventory-49821483/dnsmanagedzone.dns.cnrm.cloud.google.com/networking/dns-project-cso1-standard-core-public-dns is NotFound: Resource not found
inventory-49821483/service.serviceusage.cnrm.cloud.google.com/projects/dns-project-cso1-dns is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/platform-and-component-services-infra-log-sink is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/mgmt-project-cluster-platform-and-component-log-sink is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/org-log-sink-security-logging-project-cso1 is NotFound: Resource not found
inventory-49821483/logginglogsink.logging.cnrm.cloud.google.com/logging/org-log-sink-data-access-logging-project-cso1 is NotFound: Resource not found
```