chore(agent0-connector): remove redundant internal cm restrictions - #1347
Merged
basti1302 merged 3 commits intoAug 30, 2026
Conversation
basti1302
force-pushed
the
ope-509-remove-in-code-restriction-for-configmaps
branch
from
August 28, 2026 18:33
b633790 to
cea52be
Compare
basti1302
marked this pull request as ready for review
August 28, 2026 18:33
basti1302
force-pushed
the
ope-509-remove-in-code-restriction-for-configmaps
branch
2 times, most recently
from
August 28, 2026 18:36
27ffd07 to
922e50b
Compare
Base automatically changed from
ope-416-provide-optional-custom-clusterrole-for-agent0-connector-via
to
main
August 28, 2026 19:29
basti1302
force-pushed
the
ope-509-remove-in-code-restriction-for-configmaps
branch
4 times, most recently
from
August 29, 2026 21:23
8d89769 to
168c044
Compare
Reading ConfigMaps is disallowed via RBAC in the default clusterrole for agent0-connector, but can be allowed via custom rules for users that do not store sensitive data in config maps in their clusters. This removes the hardcoded checks that disallowed access to configmaps within agent0-connector itself.
…maps The doc comment on sensitiveContentRequested claimed that no kubectl command prints the data of a sensitive resource. That is false for `kubectl describe secret`: kubectl renders the value of the "token" key verbatim when the secret's type is kubernetes.io/service-account-token (describeSecret in kubectl v1.36.4, the version pinned in the Dockerfile). Every other key still renders as a byte count. State the gap instead of denying it. Also invert the deleted config map test cases: the removed block asserted that config map requests are rejected, but nothing asserted the new contract that they are allowed, so a regression that marks config maps sensitive again would not fail a unit test. Found by a code review of this branch.
Granting config map access via a custom cluster role was framed as a bet on the user's own data. That premise does not hold for this operator: resolveExporterHeaders renders the literal header value of a non-Dash0 export into the collector config map, so a granted read handed out third-party credentials in cleartext. Config maps now join dash0ResourceTypesWithSecrets and workloadResourceTypes as a third category behind targetsResourceTypeWithSecrets. Their content is a map of arbitrary keys to whole configuration files rather than typed fields, so redactConfigMapData parses every value of data and binaryData that is JSON or a YAML object/list and walks it with the same credential fields the resources themselves are walked for. A value is rendered again only when the walk replaced something, so a value holding no credential is handed out byte for byte. The walk is bound to kind: ConfigMap, since "data" is a generic field name. Being a resource type that can contain secrets also restricts config maps to the output formats the connector can redact: kubectl describe, -o go-template/jsonpath/custom-columns/kyaml, --template and a --sort-by below anything but metadata or status are rejected for them now, exactly as for the other two categories. The redaction is not exhaustive. A credential in a format the connector cannot parse, one under a field name the walk does not know is returned as it is. Config maps stay absent from the default RBAC rules for that reason.
basti1302
force-pushed
the
ope-509-remove-in-code-restriction-for-configmaps
branch
from
August 30, 2026 15:53
168c044 to
c63e2bd
Compare
Member
Author
|
/run-e2e |
Contributor
🚀 E2E tests triggered
Results will be posted here once the tests complete. You can also view the workflow runs directly. |
Contributor
✅ E2E tests passed
|
basti1302
deleted the
ope-509-remove-in-code-restriction-for-configmaps
branch
August 30, 2026 16:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reading ConfigMaps is disallowed via RBAC in the default clusterrole for agent0-connector, but can be allowed via custom rules for users that do not store sensitive data in config maps in their clusters.
This removes the hardcoded checks that disallowed access to configmaps within agent0-connector itself.