You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix: guard DNSRecordSet activity summaries against missing fields
Several DNSRecordSet create/update/delete/system activity rules built
their summary from annotations or spec fields that the rule's match did
not guarantee were present. When a record set lacked the dereferenced
key, summary evaluation errored (no such key) and the activity event was
dead-lettered, so the operation never appeared in the activity feed.
Tighten each affected rule's match so events missing a field fall
through to the existing generic and last-resort fallback rules instead
of erroring.
Key changes:
- A/AAAA, CNAME, ALIAS, MX create/update rules now require the
display-value annotation their summary reads
- Rules whose summary or match reads spec.recordType now require
has(...spec.recordType): type-specific create/update, create/update
-other-annotated, create/update-from-request, delete-from-response,
and both system-create rules
- Summary wording is unchanged; the fallback chain (generic record-type
summary, then "a DNS record") requires no field access and stays safe
Claude-Session: https://claude.ai/code/session_01KnYuL5Pf1R5ysZoxxNkKiu
summary: "{{ actor }} added {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }} as an alias for {{ audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-value'] }}"
59
59
60
60
# ALIAS records with display annotations: "added example.com as an alias for lb.example.com"
summary: "{{ actor }} added {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }} as an alias for {{ audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-value'] }}"
64
64
65
65
# MX records with display annotations: "configured mail for example.com using 10 mail.example.com"
summary: "{{ actor }} configured mail for {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }} using {{ audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-value'] }}"
69
69
70
70
# TXT records with display annotations: "added TXT record for example.com"
summary: "{{ actor }} added a TXT record for {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }}"
74
74
75
75
# NS records with display annotations: "added nameservers for sub.example.com"
summary: "{{ actor }} added a {{ audit.requestObject.spec.recordType }} record for {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }}"
84
84
85
85
# Create with audit.requestObject.spec but no display annotations: "added an A record"
86
86
# Uses audit.requestObject.spec which is available at Request audit level and above.
match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.requestObject.spec.recordType) && audit.requestObject.spec.recordType in ['A', 'AAAA'] && has(audit.responseObject.metadata.annotations) && 'dns.networking.miloapis.com/display-name' in audit.responseObject.metadata.annotations && 'dns.networking.miloapis.com/display-value' in audit.responseObject.metadata.annotations"
116
116
summary: "{{ actor }} updated {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }} to point to {{ audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-value'] }}"
117
117
118
118
# CNAME records with display annotations: "updated api.example.com to alias api.v2.example.com"
119
119
- name: update-cname
120
-
match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && audit.requestObject.spec.recordType== 'CNAME' && has(audit.responseObject.metadata.annotations) && 'dns.networking.miloapis.com/display-name' in audit.responseObject.metadata.annotations"
120
+
match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.requestObject.spec.recordType) && audit.requestObject.spec.recordType == 'CNAME' && has(audit.responseObject.metadata.annotations) && 'dns.networking.miloapis.com/display-name' in audit.responseObject.metadata.annotations && 'dns.networking.miloapis.com/display-value' in audit.responseObject.metadata.annotations"
121
121
summary: "{{ actor }} updated {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }} to alias {{ audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-value'] }}"
122
122
123
123
# Generic update with display annotations
124
124
- name: update-other-annotated
125
-
match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.responseObject.metadata.annotations) && 'dns.networking.miloapis.com/display-name' in audit.responseObject.metadata.annotations && has(audit.requestObject.spec)"
125
+
match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.responseObject.metadata.annotations) && 'dns.networking.miloapis.com/display-name' in audit.responseObject.metadata.annotations && has(audit.requestObject.spec) && has(audit.requestObject.spec.recordType)"
126
126
summary: "{{ actor }} updated {{ audit.requestObject.spec.recordType }} record {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }}"
127
127
128
128
# Update with audit.requestObject.spec but no display annotations: "updated an A record"
summary: "Default {{ audit.requestObject.spec.recordType }} record created for {{ link(audit.responseObject.metadata.annotations['dns.networking.miloapis.com/display-name'], audit.objectRef) }}"
143
143
144
144
# System-created records with spec but no display annotations
0 commit comments