While testing ACM provisioning many SNOs via ZTP, and then ZTP upgrading those SNOs from 4.9.46 to 4.10.28, almost all of the common-config policy per clusters became NonCompliant.  Upon examining why the policies became NonCompliant, it seems the cluster-monitoring-config was changed/replaced during the upgrade.

4.9.46 -> 4.10.28

Always

1.
2.
3.

# oc --kubeconfig=/root/hv-vm/sno/manifests/sno00001/kubeconfig get cm -n openshift-monitoring cluster-monitoring-config  -o yaml
apiVersion: v1
data:
  config.yaml: |
    alertmanagerMain:
      nodeSelector: null
      resources: null
      tolerations: null
      volumeClaimTemplate: null
    enableUserWorkload: null
    grafana:
      nodeSelector: null
      tolerations: null
    http: null
    k8sPrometheusAdapter: null
    kubeStateMetrics: null
    openshiftStateMetrics: null
    prometheusK8s:
      additionalAlertManagerConfigs:
      - apiVersion: v2
        bearerToken:
          key: token
          name: observability-alertmanager-accessor
        pathPrefix: /
        scheme: https
        staticConfigs:
        - alertmanager-open-cluster-management-observability.apps.bm-stage.rdu2.scalelab.redhat.com
        tlsConfig:
          ServerName: ""
          ca:
            key: service-ca.crt
            name: hub-alertmanager-router-ca
          insecureSkipVerify: false
      externalLabels:
        cluster: ccf6f406-53d9-4232-894d-db02695cf189
      logLevel: ""
      nodeSelector: null
      remoteWrite: null
      resources: null
      retention: 24h
      tolerations: null
      volumeClaimTemplate: null
    prometheusOperator: null
    telemeterClient: null
    thanosQuerier: null
kind: ConfigMap
metadata:
  creationTimestamp: "2022-09-01T18:52:16Z"
  name: cluster-monitoring-config
  namespace: openshift-monitoring
  resourceVersion: "263306"
  uid: f80d71cd-b3ba-43c7-b8b4-078f4a87d3c4

apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-monitoring-config
  namespace: openshift-monitoring
  annotations:
    ran.openshift.io/ztp-deploy-wave: "1"
data:
  config.yaml: |
    grafana:
      enabled: false
    alertmanagerMain:
      enabled: false
    prometheusK8s:
       retention: 24h