Skip to content

fix(runpod): strip pod spec before saving collected output - #2105

Merged
xavpaice merged 1 commit into
mainfrom
xavpaice/sc-139179/runpod-collector-exposes-sensitive-pod-spec
Aug 11, 2026
Merged

fix(runpod): strip pod spec before saving collected output#2105
xavpaice merged 1 commit into
mainfrom
xavpaice/sc-139179/runpod-collector-exposes-sensitive-pod-spec

Conversation

@xavpaice

Copy link
Copy Markdown
Member

The runPod collector was saving the full Kubernetes Pod object (including Spec) to the bundle. Because the PodSpec can contain env vars, commands, args, volumes, and imagePullSecrets, this leaked sensitive data into the collected output.

Changes:

  • In savePodDetails, copy the fetched pod and zero its Spec before JSON-marshaling.
  • Refactor savePodDetails to accept kubernetes.Interface and drop the unused clientConfig parameter so the function can be unit-tested with the fake client.

Verification:

  • Added TestSavePodDetails_StripsPodSpec.
  • make test and make build pass.

This also affects the deprecated run collector and goldpinger, both of which delegate to CollectRunPod. Goldpinger only reads pod.Name and pod.Status.ContainerStatuses, so it remains compatible.

@greptile-apps

greptile-apps Bot commented Aug 11, 2026

Copy link
Copy Markdown

Reviews (1): Last reviewed commit: "fix(runpod): strip pod spec before savin..." | Re-trigger Greptile

@xavpaice
xavpaice merged commit 0e2e0cd into main Aug 11, 2026
29 checks passed
@xavpaice
xavpaice deleted the xavpaice/sc-139179/runpod-collector-exposes-sensitive-pod-spec branch August 11, 2026 21:13
@gilday

gilday commented Aug 21, 2026

Copy link
Copy Markdown

Should this zero out ObjectMeta.annotations and .labels in addition to the Spec?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants