#7729·headlamp

frontend: resourceMap: Incomplete relation matching for Pods and Jobs referencing Secrets, ConfigMaps, and Roles

Author: harshitttt077Created Sep 21, 2026Updated Sep 21, 2026
Labelskind/bug

Describe the bug

In the Resource Map view (frontend/src/components/resourceMap/sources/definitions/relations.tsx), several common Kubernetes consumption patterns for Secrets, ConfigMaps, and Roles are omitted or mismatched, leading to missing dependency edges:

  1. Direct Secret Volume Mounts: pod-secret only checks container env.valueFrom.secretKeyRef and projected volumes, missing standard volumes[*].secret.secretName (the most common method for mounting TLS certificates and credentials).
  2. Environment Source Blocks (envFrom): pod-configmap, job-configmap, pod-secret, and job-secret do not inspect containers[*].envFrom (configMapRef / secretRef).
  3. ConfigMap Key References in Env: pod-configmap and job-configmap only inspect volume mounts, omitting individual environment variables injected via containers[*].env[*].valueFrom.configMapKeyRef.
  4. Init & Ephemeral Containers: Only spec.containers is evaluated; initContainers and ephemeralContainers are omitted across all Pod and Job predicates.
  5. RoleBinding Role Ref Validation: rolebinding-role matches on role.metadata.name === binding.roleRef.name without validating binding.roleRef.kind === 'Role'. If a RoleBinding references a ClusterRole that happens to share a name with a namespaced Role, an incorrect edge is created.

Expected outcome: The Resource Map graph should accurately render dependency edges for all standard Kubernetes reference paths (direct volumes, projected volumes, env, envFrom, and initContainers), and rolebinding-role should only link to namespaced Roles when roleRef.kind === 'Role'.

To Reproduce

Steps to reproduce the bug:

  1. Deploy a Pod that mounts a Secret via volumes: [{ name: "my-sec", secret: { secretName: "app-secret" } }].
  2. Deploy a Pod that injects environment variables via envFrom: [{ configMapRef: { name: "app-config" } }].
  3. Open Headlamp and navigate to Resource Map for that namespace.
  4. Observe that neither the Secret nor the ConfigMap shows an edge connected to the respective Pod.

Environment (please provide info about your environment):

  • Installation type: Desktop / In-Cluster / Local Dev
  • Headlamp Version: Latest main (0.42.0-dev)
  • Other: Reproducible on any Kubernetes cluster

Are you able to fix this issue?

Yes (I will propose a PR)

Additional Context

The relevant predicates are located in:

  • frontend/src/components/resourceMap/sources/definitions/relations.tsx (lines 178–205 for Pod/Job ConfigMap/Secret predicates, and lines 275–280 for rolebinding-role).
  • Existing tests in frontend/src/components/resourceMap/sources/definitions/relations.test.tsx (lines 326–394) currently only cover volumes.configMap and env.valueFrom.secretKeyRef.

Source: kubernetes-sigs/headlamp