Skip to content

FindReferencingConfigMaps and FindReferencingSecrets miss CronJob references #6761

@Ram04102007

Description

@Ram04102007

What's the problem

While looking at the code after #6528 was fixed, I noticed that
FindReferencingConfigMaps and FindReferencingSecrets have the same
gap — they don't handle CronJobs.

Both functions only look through spec.template.spec.*, which works
for Deployments, StatefulSets, and DaemonSets. But CronJobs put their
pod template under spec.jobTemplate.spec.template.spec.*, so any
ConfigMap or Secret referenced inside a CronJob is completely invisible
to these functions.

What breaks

If a CronJob mounts a ConfigMap as a volume or pulls credentials from a
Secret via env, PipeCD won't know about it. That means drift detection
won't catch config changes, and re-deploys won't be triggered when those
configs change.

Paths that are currently missed

FindReferencingConfigMaps:

  • spec.jobTemplate.spec.template.spec.volumes.configMap.name
  • spec.jobTemplate.spec.template.spec.containers.env.valueFrom.configMapKeyRef.name
  • spec.jobTemplate.spec.template.spec.containers.envFrom.configMapRef.name
  • spec.jobTemplate.spec.template.spec.initContainers.env.valueFrom.configMapKeyRef.name
  • spec.jobTemplate.spec.template.spec.initContainers.envFrom.configMapRef.name

FindReferencingSecrets:

  • spec.jobTemplate.spec.template.spec.volumes.secret.secretName
  • spec.jobTemplate.spec.template.spec.containers.env.valueFrom.secretKeyRef.name
  • spec.jobTemplate.spec.template.spec.containers.envFrom.secretRef.name
  • spec.jobTemplate.spec.template.spec.initContainers.env.valueFrom.secretKeyRef.name
  • spec.jobTemplate.spec.template.spec.initContainers.envFrom.secretRef.name

The fix is straightforward — add the missing nestedStringSlice probes
for the jobTemplate paths, same pattern already used for the existing paths.

Affects both kubernetes and kubernetes_multicluster provider packages.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions