chore(agent0-connector): remove redundant internal cm restrictions (#1347)

Reading ConfigMaps is disallowed via RBAC in the default clusterrole for
agent0-connector, but can be allowed via custom rules for users that do
not store sensitive data in config maps in their clusters.

This removes the hardcoded checks that disallowed access to configmaps
within agent0-connector itself.

Author: basti1302

CLAUDE.md

@@ -106,20 +106,9 @@ and the output formats that can reshape a value (`-o go-template/jsonpath/custom
 because their output cannot be redacted. A credential-bearing CRD that is missing from the list therefore stays fully
 readable through those formats as well.
 
-`dash0ResourceTypesWithSecrets` is one of two lists behind `targetsResourceTypeWithSecrets`. The other is
+`dash0ResourceTypesWithSecrets` is one of three lists behind `targetsResourceTypeWithSecrets`. The second is
 `workloadResourceTypes`, the Kubernetes resource types that carry a pod spec (pods, deployments, daemonsets, jobs,
-controller revisions, ...). Any workload can hold a credential in the literal value of an environment variable, so
-`redactEnvVarValues` replaces the value of every environment variable of a pod spec, and these resource types are
-restricted to the same output formats as the Dash0 custom resources. An environment variable that sources its value via
-`valueFrom` is left untouched, and so are the header values of the HTTP probes and lifecycle hooks of a pod spec, which
-are redacted via the same `httpHeaders` case as the header values of an export.
-
-For every resource type that can contain secrets, `--sort-by` is restricted as well (`unsafeSortByRequested`,
-`unsafeSortByOfSensitiveResourceRequested`): kubectl evaluates the expression against the resources before the
-connector sees them, so sorting by a redacted field leaks its order, and a filter expression such as
-`{.spec.containers[0].env[?(@.value>"S")].name}` turns a match into a comparison oracle that reveals the value over
- several requests. Only a plain path below `metadata` or `status` is accepted, except `metadata.annotations`, which
-holds the verbatim copy of the spec that `kubectl apply` leaves behind.
+controller revisions, ...). The third is `configMapResourceTypes`.
 
 When adding or changing a CRD, check all four lists above - grep for `dash0ResourceTypesWithSecrets`,
 `credentialFieldsPerConfigObject` and `urlFieldsPerConfigObject`, and read the `case` clauses of

helm-chart/dash0-operator/files/agent0-connector-default-cluster-role-rules.yaml

@@ -15,9 +15,9 @@
 #
 # Users can replace these rules entirely via the Helm value operator.agent0Connector.clusterRole.rules.
 
-# Read-only access to core API group resource types. Resources which can hold sensitive user data (secrets, config maps)
-# are deliberately absent, so that they cannot be read at all, independent of the validation & redaction the
-# agent0-connector applies to a command request.
+# Read-only access to core API group resource types. Configmaps are absent as a defensive default value, since
+# configmaps can hold sensitive values in some setups. Users that want to allow access to configmaps can do so by
+# providing custom RBAC rules for agent0-connector.
 - apiGroups:
   - ""
   resources:

helm-chart/dash0-operator/values.yaml

@@ -1288,10 +1288,12 @@ operator:
       # Additional annotations for the pods of the Edge Proxy deployment managed by the operator.
       podAnnotations: {}
 
-  # Settings related to the Agent0 connector (experimental/beta).
+  # Settings related to the Agent0 connector (experimental).
   agent0Connector:
 
-    # The agent0-connector feature is currently experimental, do not enable it (yet).
+    # The agent0-connector feature is currently experimental, do not enable it.
+    #
+    # All other settings in operator.agent0Connector will be ignored if operator.agent0Connector.enabled is false.
     enabled: false
 
     # The address (host:port) of the Dash0 backend service the agent0-connector pod connects to. This value is mandatory
@@ -1323,8 +1325,8 @@ operator:
       # secret with the command above (see property "name"), you would set the property to "token".
       key:
 
-    # Disables TLS for the agent0-connector workload's connection to the Dash0 backend, connecting via plaintext
-    # instead. This is only intended for local development.
+    # Disables TLS for the agent0-connector's connection to the Dash0 backend, connecting via plaintext instead. This
+    # is only intended for local development.
     insecure: false
 
     # Resource settings for the agent0-connector container of the agent0-connector deployment managed by the operator.
@@ -1341,6 +1343,47 @@ operator:
       requests:
         memory: 32Mi
 
+    # Additional labels to be set on the agent0-connector deployment managed by the operator.
+    labels: {}
+
+    # Additional annotations to be set on the agent0-connector deployment managed by the operator.
+    annotations: {}
+
+    # Additional labels to be set on the agent0-connector deployment pods managed by the operator.
+    podLabels: {}
+
+    # Additional annotations to be set on the agent0-connector deployment pods managed by the operator.
+    podAnnotations: {}
+
+    # An array of tolerations for the agent0-connector deployment managed by the operator. This can be used to make sure
+    # that the agent0-connector pod can be scheduled on nodes where it would not be scheduled otherwise due to
+    # Kubernetes taints.
+    # Example:
+    # tolerations:
+    #   - key: "key1"
+    #     operator: "Equal"
+    #     value: "value1"
+    #     effect: "NoSchedule"
+    #   - key: "key2"
+    #     operator: "Exists"
+    #     effect: "NoSchedule"
+    tolerations: []
+
+    # The nodeAffinity for the agent0-connector deployment managed by the operator. This can be used to constrain which
+    # nodes the agent0-connector pod will be scheduled on.
+    #
+    # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: "dash0.com/enable"
+                operator: "NotIn"
+                values: ["false"]
+              - key: "kubernetes.io/os"
+                operator: "In"
+                values: ["linux"]
+
     # Settings for the cluster role the operator creates for the agent0-connector.
     clusterRole:
 
@@ -1364,14 +1407,33 @@ operator:
       # "kubectl auth can-i" requires and which cannot modify cluster state. Any other verb, in particular a write verb
       # like "create", "update", "patch" or "delete", as well as the wildcard "*", makes the Helm installation fail.
       #
-      # Note that reading the content of Kubernetes secrets is rejected by the agent0-connector itself, independent of
-      # the rules configured here.
+      # Allowing access to additional resources can have security implications. Only grant access to additional
+      # resources types when you are confident that it cannot be used to exfiltrate sensitive data (auth tokens,
+      # credentials, API secrets etc.) from the cluster. Failure to do so makes these secrets accessible to anyone who
+      # has access to your Dash0 organization. The agent0-connector component uses a set of restrictions and redaction
+      # mechanisms to prevent leaking secrets. The following are redacted:
+      # * the environment variable values and probe headers of any workload,
+      # * all credential fields in any of the Dash0 custom resources.
+      # Automatic redaction is also applied to the JSON or YAML content of ConfigMaps, if access to ConfigMaps is
+      # granted via custom RBAC rules. (ConfigMaps are inaccessible under the default RBAC rules.) The redaction of
+      # ConfigMap content is best-effort: the connector parses every value of data and binaryData that is a JSON or
+      # YAML object or list, including a YAML value that holds several documents, and replaces the values of certain
+      # key names (token, password, headers, queryParameters, httpHeaders). The values of binaryData are base64 and are
+      # decoded before they are inspected and encoded again afterwards. A credential in a format the connector cannot
+      # parse (a properties file, a shell script), or under a key name it does not know, is returned unredacted. That
+      # is to say, only allow access to ConfigMaps if they do not contain secrets, or if the redaction described here
+      # is sufficient.
+      #
+      # Note that a ConfigMap value the connector did redact something in is re-rendered as a whole, which drops its
+      # comments and normalizes its key order and scalar notation. A value nothing was redacted from is returned byte
+      # for byte.
       #
-      # For every other resource type, the agent0-connector redacts the credentials it knows about from a response
-      # before it leaves the cluster. Secret redaction is applied to Dash0 custom resources and the Kubernetes resource
-      # types which carry a pod spec (environment variable values are redacted). Granting access to a resource type
-      # outside that set, for example a third-party custom resource which holds a credential, returns its content
-      # unredacted.
+      # The content of every resource type outside the set mentioned above (standard Kubernetes workload resources,
+      # Dash0 custom resources, and JSON/YAML ConfigMap content) is returned verbatim, i.e. unredacted.
+      #
+      # Reading the *content* of Kubernetes secrets is rejected by the agent0-connector itself, independent of
+      # the rules configured here. (Listing secrets and checking for their presence is allowed, if the rules list the
+      # secrets resource type - the default rules do not include access to secrets).
       #
       # By default, Kubernetes grants the verb "get" for the API discovery URLs (/api, /apis, /openapi/v3, ..., all of
       # which are required for this component) to the group system:authenticated via the system:discovery cluster role
@@ -1391,44 +1453,3 @@ operator:
       #     resources: ["selfsubjectaccessreviews", "selfsubjectrulesreviews"]
       #     verbs: ["create"]
       rules: []
-
-    # Additional labels to be set on the agent0-connector deployment managed by the operator.
-    labels: {}
-
-    # Additional annotations to be set on the agent0-connector deployment managed by the operator.
-    annotations: {}
-
-    # Additional labels to be set on the agent0-connector deployment pods managed by the operator.
-    podLabels: {}
-
-    # Additional annotations to be set on the agent0-connector deployment pods managed by the operator.
-    podAnnotations: {}
-
-    # An array of tolerations for the agent0-connector deployment managed by the operator. This can be used to make sure
-    # that the agent0-connector pod can be scheduled on nodes where it would not be scheduled otherwise due to
-    # Kubernetes taints.
-    # Example:
-    # tolerations:
-    #   - key: "key1"
-    #     operator: "Equal"
-    #     value: "value1"
-    #     effect: "NoSchedule"
-    #   - key: "key2"
-    #     operator: "Exists"
-    #     effect: "NoSchedule"
-    tolerations: []
-
-    # The nodeAffinity for the agent0-connector deployment managed by the operator. This can be used to constrain which
-    # nodes the agent0-connector pod will be scheduled on.
-    #
-    # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-          - matchExpressions:
-              - key: "dash0.com/enable"
-                operator: "NotIn"
-                values: ["false"]
-              - key: "kubernetes.io/os"
-                operator: "In"
-                values: ["linux"]

images/agent0-connector/src/go.mod

@@ -5,14 +5,14 @@ go 1.27.0
 require (
 	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/trace v1.45.0
+	go.yaml.in/yaml/v2 v2.4.2
 	google.golang.org/grpc v1.83.1
 	google.golang.org/protobuf v1.36.12
 	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect