What's the problem
While looking at the code after #6528 was fixed, I noticed that
FindReferencingConfigMaps and FindReferencingSecrets have the same
gap — they don't handle CronJobs.
Both functions only look through spec.template.spec.*, which works
for Deployments, StatefulSets, and DaemonSets. But CronJobs put their
pod template under spec.jobTemplate.spec.template.spec.*, so any
ConfigMap or Secret referenced inside a CronJob is completely invisible
to these functions.
What breaks
If a CronJob mounts a ConfigMap as a volume or pulls credentials from a
Secret via env, PipeCD won't know about it. That means drift detection
won't catch config changes, and re-deploys won't be triggered when those
configs change.
Paths that are currently missed
FindReferencingConfigMaps:
- spec.jobTemplate.spec.template.spec.volumes.configMap.name
- spec.jobTemplate.spec.template.spec.containers.env.valueFrom.configMapKeyRef.name
- spec.jobTemplate.spec.template.spec.containers.envFrom.configMapRef.name
- spec.jobTemplate.spec.template.spec.initContainers.env.valueFrom.configMapKeyRef.name
- spec.jobTemplate.spec.template.spec.initContainers.envFrom.configMapRef.name
FindReferencingSecrets:
- spec.jobTemplate.spec.template.spec.volumes.secret.secretName
- spec.jobTemplate.spec.template.spec.containers.env.valueFrom.secretKeyRef.name
- spec.jobTemplate.spec.template.spec.containers.envFrom.secretRef.name
- spec.jobTemplate.spec.template.spec.initContainers.env.valueFrom.secretKeyRef.name
- spec.jobTemplate.spec.template.spec.initContainers.envFrom.secretRef.name
The fix is straightforward — add the missing nestedStringSlice probes
for the jobTemplate paths, same pattern already used for the existing paths.
Affects both kubernetes and kubernetes_multicluster provider packages.
What's the problem
While looking at the code after #6528 was fixed, I noticed that
FindReferencingConfigMapsandFindReferencingSecretshave the samegap — they don't handle CronJobs.
Both functions only look through
spec.template.spec.*, which worksfor Deployments, StatefulSets, and DaemonSets. But CronJobs put their
pod template under
spec.jobTemplate.spec.template.spec.*, so anyConfigMap or Secret referenced inside a CronJob is completely invisible
to these functions.
What breaks
If a CronJob mounts a ConfigMap as a volume or pulls credentials from a
Secret via env, PipeCD won't know about it. That means drift detection
won't catch config changes, and re-deploys won't be triggered when those
configs change.
Paths that are currently missed
FindReferencingConfigMaps:FindReferencingSecrets:The fix is straightforward — add the missing
nestedStringSliceprobesfor the jobTemplate paths, same pattern already used for the existing paths.
Affects both
kubernetesandkubernetes_multiclusterprovider packages.