Feature Overview

As a policy administrator it can be difficult to determine why policies flap between compliant and non-compliant when set to enforce. Additionally inform policies may remain non-compliant despite no detectable difference between the object defined in policy and the live object.

Currently ACM logs include the difference between an object specified in a policy and the live object on the cluster when the policy is determined as non-compliant.

My suggestion is to add the debug log flag using a boolean field such as `spec.[].objectDefinition.spec.[].object-templates.[].diffCapture` to the `policy.
policy.open-cluster-management` CR.
When a policy administrator enables this field ACM log the difference between that object defined in policy and the live object it's being compared to.

Adding the debug flag at the object-template level would provide granular control over where it's enabled, preventing generation of excessive logs and minimising the amount of resources required to provide the diff log.