Skip to content

fix(redactors): move redactor storage from ConfigMaps to Secrets #6033

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xavpaice merged 2 commits into from
Aug 23, 2026
Merged

fix(redactors): move redactor storage from ConfigMaps to Secrets #6033

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4d360be
fix(redactors): move rendered redactor specs from ConfigMaps to Secrets
xavpaice Aug 20, 2026
b3c801e
fix(redactors): move kotsadm-redact backend from ConfigMap to Secret
xavpaice Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
143 changes: 76 additions & 67 deletions go.mod
View file
Open in desktop

Large diffs are not rendered by default.

318 changes: 161 additions & 157 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

9 changes: 9 additions & 0 deletions pkg/apiserver/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"github.com/replicatedhq/kots/pkg/policy"
"github.com/replicatedhq/kots/pkg/prune"
"github.com/replicatedhq/kots/pkg/rbac"
"github.com/replicatedhq/kots/pkg/redact"
"github.com/replicatedhq/kots/pkg/reporting"
"github.com/replicatedhq/kots/pkg/session"
"github.com/replicatedhq/kots/pkg/snapshotscheduler"
Expand Down Expand Up @@ -96,6 +97,14 @@ func Start(params *APIServerParams) {
log.Println("Failed to clean up legacy support bundle spec configmaps: ", err)
}

if err := redact.MigrateRedactConfigMap(k8sClientset); err != nil {
log.Println("Failed to migrate kotsadm-redact configmap to secret: ", err)
}

if err := supportbundle.CleanupLegacyRedactSpecConfigMaps(context.TODO(), k8sClientset, util.PodNamespace); err != nil {
log.Println("Failed to clean up legacy redactor spec configmaps: ", err)
}

op := operator.Init(operatorClient, kotsStore, params.AutocreateClusterToken, k8sClientset)
if err := op.Start(); err != nil {
log.Println("error starting the operator")
Expand Down
40 changes: 21 additions & 19 deletions pkg/redact/app.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,15 @@ import (
"k8s.io/client-go/kubernetes/scheme"
)

func GetAppRedactSpecConfigMapName(appSlug string) string {
func GetAppRedactSpecSecretName(appSlug string) string {
return fmt.Sprintf("kotsadm-%s-redact-spec", appSlug)
}

func GetAppRedactSpecURI(appSlug string) string {
return fmt.Sprintf("configmap/%s/%s/%s", util.PodNamespace, GetAppRedactSpecConfigMapName(appSlug), redactSpecDataKey)
return fmt.Sprintf("secret/%s/%s/%s", util.PodNamespace, GetAppRedactSpecSecretName(appSlug), redactSpecDataKey)
}

// CreateRenderedAppRedactSpec creates a configmap that contains the redaction yaml spec included in the application release
// CreateRenderedAppRedactSpec creates a secret that contains the redaction yaml spec included in the application release
func CreateRenderedAppRedactSpec(clientset kubernetes.Interface, app *apptypes.App, sequence int64, kotsKinds *kotsutil.KotsKinds) error {
builtRedactor := kotsKinds.Redactor.DeepCopy()
if builtRedactor == nil {
Expand Down Expand Up @@ -56,45 +56,47 @@ func CreateRenderedAppRedactSpec(clientset kubernetes.Interface, app *apptypes.A
}
renderedSpec := string(rs)

configMapName := GetAppRedactSpecConfigMapName(app.GetSlug())
secretName := GetAppRedactSpecSecretName(app.GetSlug())

existingConfigMap, err := clientset.CoreV1().ConfigMaps(util.PodNamespace).Get(context.TODO(), configMapName, metav1.GetOptions{})
existingSecret, err := clientset.CoreV1().Secrets(util.PodNamespace).Get(context.TODO(), secretName, metav1.GetOptions{})
if err != nil && !kuberneteserrors.IsNotFound(err) {
return errors.Wrap(err, "failed to read redactor configmap")
return errors.Wrap(err, "failed to read redactor secret")
} else if kuberneteserrors.IsNotFound(err) {
configMap := &corev1.ConfigMap{
secret := &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: "v1",
Kind: "ConfigMap",
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: configMapName,
Name: secretName,
Namespace: util.PodNamespace,
Labels: kotsadmtypes.GetKotsadmLabels(),
},
Data: map[string]string{
redactSpecDataKey: renderedSpec,
Data: map[string][]byte{
redactSpecDataKey: []byte(renderedSpec),
},
}

_, err = clientset.CoreV1().ConfigMaps(util.PodNamespace).Create(context.TODO(), configMap, metav1.CreateOptions{})
_, err = clientset.CoreV1().Secrets(util.PodNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
if err != nil {
return errors.Wrap(err, "failed to create redactor configmap")
return errors.Wrap(err, "failed to create redactor secret")
}

deleteLegacyRedactSpecConfigMap(clientset, secretName)
return nil
}

if existingConfigMap.Data == nil {
existingConfigMap.Data = map[string]string{}
if existingSecret.Data == nil {
existingSecret.Data = map[string][]byte{}
}
existingConfigMap.Data[redactSpecDataKey] = renderedSpec
existingConfigMap.ObjectMeta.Labels = kotsadmtypes.GetKotsadmLabels()
existingSecret.Data[redactSpecDataKey] = []byte(renderedSpec)
existingSecret.ObjectMeta.Labels = kotsadmtypes.GetKotsadmLabels()

_, err = clientset.CoreV1().ConfigMaps(util.PodNamespace).Update(context.TODO(), existingConfigMap, metav1.UpdateOptions{})
_, err = clientset.CoreV1().Secrets(util.PodNamespace).Update(context.TODO(), existingSecret, metav1.UpdateOptions{})
if err != nil {
return errors.Wrap(err, "failed to update redactor configmap")
return errors.Wrap(err, "failed to update redactor secret")
}

deleteLegacyRedactSpecConfigMap(clientset, secretName)
return nil
}
42 changes: 22 additions & 20 deletions pkg/redact/default.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,16 +18,16 @@ import (
)

const (
defaultRedactSpecConfigMapName = "kotsadm-redact-default-spec"
defaultRedactSpecDataKey = "default-redactor"
ipv4AddressRegex = "(?P<mask>\\b(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b)"
defaultRedactSpecName = "kotsadm-redact-default-spec"
defaultRedactSpecDataKey = "default-redactor"
ipv4AddressRegex = "(?P<mask>\\b(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(?P<drop>25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b)"
)

func GetDefaultRedactSpecURI() string {
return fmt.Sprintf("configmap/%s/%s/%s", util.PodNamespace, defaultRedactSpecConfigMapName, defaultRedactSpecDataKey)
return fmt.Sprintf("secret/%s/%s/%s", util.PodNamespace, defaultRedactSpecName, defaultRedactSpecDataKey)
}

// CreateRenderedDefaultRedactSpec creates a configmap that contains the default redaction yaml spec for the admin console
// CreateRenderedDefaultRedactSpec creates a secret that contains the default redaction yaml spec for the admin console
func CreateRenderedDefaultRedactSpec(clientset kubernetes.Interface) error {
redactor := getDefaultRedactor()

Expand All @@ -36,46 +36,48 @@ func CreateRenderedDefaultRedactSpec(clientset kubernetes.Interface) error {
if err := s.Encode(redactor, &b); err != nil {
return errors.Wrap(err, "failed to serialize default redactor")
}
spec := b.String()
spec := b.Bytes()

existingConfigMap, err := clientset.CoreV1().ConfigMaps(util.PodNamespace).Get(context.TODO(), defaultRedactSpecConfigMapName, metav1.GetOptions{})
existingSecret, err := clientset.CoreV1().Secrets(util.PodNamespace).Get(context.TODO(), defaultRedactSpecName, metav1.GetOptions{})
if err != nil && !kuberneteserrors.IsNotFound(err) {
return errors.Wrap(err, "failed to read default redactor configmap")
return errors.Wrap(err, "failed to read default redactor secret")
} else if kuberneteserrors.IsNotFound(err) {
configMap := &corev1.ConfigMap{
secret := &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: "v1",
Kind: "ConfigMap",
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: defaultRedactSpecConfigMapName,
Name: defaultRedactSpecName,
Namespace: util.PodNamespace,
Labels: kotsadmtypes.GetKotsadmLabels(),
},
Data: map[string]string{
Data: map[string][]byte{
defaultRedactSpecDataKey: spec,
},
}

_, err = clientset.CoreV1().ConfigMaps(util.PodNamespace).Create(context.TODO(), configMap, metav1.CreateOptions{})
_, err = clientset.CoreV1().Secrets(util.PodNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
if err != nil {
return errors.Wrap(err, "failed to create default redactor configmap")
return errors.Wrap(err, "failed to create default redactor secret")
}

deleteLegacyRedactSpecConfigMap(clientset, defaultRedactSpecName)
return nil
}

if existingConfigMap.Data == nil {
existingConfigMap.Data = map[string]string{}
if existingSecret.Data == nil {
existingSecret.Data = map[string][]byte{}
}
existingConfigMap.Data[defaultRedactSpecDataKey] = spec
existingConfigMap.ObjectMeta.Labels = kotsadmtypes.GetKotsadmLabels()
existingSecret.Data[defaultRedactSpecDataKey] = spec
existingSecret.ObjectMeta.Labels = kotsadmtypes.GetKotsadmLabels()

_, err = clientset.CoreV1().ConfigMaps(util.PodNamespace).Update(context.TODO(), existingConfigMap, metav1.UpdateOptions{})
_, err = clientset.CoreV1().Secrets(util.PodNamespace).Update(context.TODO(), existingSecret, metav1.UpdateOptions{})
if err != nil {
return errors.Wrap(err, "failed to update default redactor configmap")
return errors.Wrap(err, "failed to update default redactor secret")
}

deleteLegacyRedactSpecConfigMap(clientset, defaultRedactSpecName)
return nil
}

Expand Down
52 changes: 23 additions & 29 deletions pkg/redact/default_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@ import (

"github.com/replicatedhq/kots/pkg/util"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
corev1 "k8s.io/api/core/v1"
kuberneteserrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
serializer "k8s.io/apimachinery/pkg/runtime/serializer/json"
"k8s.io/client-go/kubernetes"
Expand All @@ -27,68 +29,60 @@ func Test_CreateRenderedDefaultRedactSpec(t *testing.T) {

tests := []struct {
name string
want string
client kubernetes.Interface
}{
{
name: "no existing default configmap",
want: defaultRedactorSpec,
name: "no existing secret",
client: fake.NewSimpleClientset(),
},
{
name: "existing default configmap with no data",
want: defaultRedactorSpec,
client: fake.NewSimpleClientset(&corev1.ConfigMap{
name: "existing secret with no data",
client: fake.NewSimpleClientset(&corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: defaultRedactSpecConfigMapName,
Name: defaultRedactSpecName,
Namespace: util.PodNamespace,
},
}),
},
{
name: "existing default configmap with no default data key",
want: defaultRedactorSpec,
client: fake.NewSimpleClientset(&corev1.ConfigMap{
name: "existing secret with default data key",
client: fake.NewSimpleClientset(&corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: defaultRedactSpecConfigMapName,
Name: defaultRedactSpecName,
Namespace: util.PodNamespace,
},
Data: map[string]string{},
Data: map[string][]byte{
defaultRedactSpecDataKey: []byte(defaultRedactorSpec),
},
}),
},
{
name: "existing default configmap with default data key",
want: defaultRedactorSpec,
name: "existing legacy configmap is deleted",
client: fake.NewSimpleClientset(&corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: defaultRedactSpecConfigMapName,
Name: defaultRedactSpecName,
Namespace: util.PodNamespace,
},
Data: map[string]string{
defaultRedactSpecDataKey: defaultRedactorSpec,
},
}),
},
}

for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
err := CreateRenderedDefaultRedactSpec(test.client)
assert.NoErrorf(t, err, "failed to create default redactor configmap: %v", err)
require.NoError(t, err)

configMap, err := test.client.CoreV1().ConfigMaps(util.PodNamespace).Get(context.TODO(), defaultRedactSpecConfigMapName, metav1.GetOptions{})
assert.NoErrorf(t, err, "failed to get default redactor configmap: %v", err)
secret, err := test.client.CoreV1().Secrets(util.PodNamespace).Get(context.TODO(), defaultRedactSpecName, metav1.GetOptions{})
require.NoError(t, err)

if configMap.Data == nil {
t.Errorf("expected data to be set")
}
require.NotNil(t, secret.Data)
got, ok := secret.Data[defaultRedactSpecDataKey]
require.True(t, ok)

got, ok := configMap.Data[defaultRedactSpecDataKey]
if !ok {
t.Errorf("no default redactor data key")
}
assert.Equal(t, defaultRedactorSpec, string(got))

assert.Equalf(t, test.want, got, "expected default redactor spec to be %s, got %s", test.want, got)
_, err = test.client.CoreV1().ConfigMaps(util.PodNamespace).Get(context.TODO(), defaultRedactSpecName, metav1.GetOptions{})
assert.True(t, kuberneteserrors.IsNotFound(err))
})
}
}
Loading
Loading