frontend: resourceMap: Incomplete relation matching for Pods and Jobs referencing Secrets, ConfigMaps, and Roles
Author: harshitttt077Created Sep 21, 2026Updated Sep 21, 2026
Labelskind/bug
Describe the bug
In the Resource Map view (frontend/src/components/resourceMap/sources/definitions/relations.tsx), several common Kubernetes consumption patterns for Secrets, ConfigMaps, and Roles are omitted or mismatched, leading to missing dependency edges:
- Direct Secret Volume Mounts:
pod-secretonly checks containerenv.valueFrom.secretKeyRefand projected volumes, missing standardvolumes[*].secret.secretName(the most common method for mounting TLS certificates and credentials). - Environment Source Blocks (
envFrom):pod-configmap,job-configmap,pod-secret, andjob-secretdo not inspectcontainers[*].envFrom(configMapRef/secretRef). - ConfigMap Key References in Env:
pod-configmapandjob-configmaponly inspect volume mounts, omitting individual environment variables injected viacontainers[*].env[*].valueFrom.configMapKeyRef. - Init & Ephemeral Containers: Only
spec.containersis evaluated;initContainersandephemeralContainersare omitted across all Pod and Job predicates. - RoleBinding Role Ref Validation:
rolebinding-rolematches onrole.metadata.name === binding.roleRef.namewithout validatingbinding.roleRef.kind === 'Role'. If a RoleBinding references aClusterRolethat happens to share a name with a namespacedRole, an incorrect edge is created.
Expected outcome:
The Resource Map graph should accurately render dependency edges for all standard Kubernetes reference paths (direct volumes, projected volumes, env, envFrom, and initContainers), and rolebinding-role should only link to namespaced Roles when roleRef.kind === 'Role'.
To Reproduce
Steps to reproduce the bug:
- Deploy a Pod that mounts a Secret via
volumes: [{ name: "my-sec", secret: { secretName: "app-secret" } }]. - Deploy a Pod that injects environment variables via
envFrom: [{ configMapRef: { name: "app-config" } }]. - Open Headlamp and navigate to Resource Map for that namespace.
- Observe that neither the Secret nor the ConfigMap shows an edge connected to the respective Pod.
Environment (please provide info about your environment):
- Installation type: Desktop / In-Cluster / Local Dev
- Headlamp Version: Latest
main(0.42.0-dev) - Other: Reproducible on any Kubernetes cluster
Are you able to fix this issue?
Yes (I will propose a PR)
Additional Context
The relevant predicates are located in:
frontend/src/components/resourceMap/sources/definitions/relations.tsx(lines 178–205 for Pod/Job ConfigMap/Secret predicates, and lines 275–280 forrolebinding-role).- Existing tests in
frontend/src/components/resourceMap/sources/definitions/relations.test.tsx(lines 326–394) currently only covervolumes.configMapandenv.valueFrom.secretKeyRef.
Source: kubernetes-sigs/headlamp