From 446d883f4ff7cf11a8e81b6e298d1b3cc839aea9 Mon Sep 17 00:00:00 2001 From: Alexandros Touloupis Date: Fri, 7 Aug 2026 17:17:35 +0300 Subject: [PATCH 1/2] feat(chart): grant Endpoints access + informer, expose configMap & env capture Adds the endpoints resource to the ClusterRole + informer gate (has_endpoints), and exposes configMapCapture and envCapture (hash-by-default value capture with clearText / redactKeyPatterns / captureCap knobs) in values.yaml + config.json. --- templates/configmap.yaml | 20 ++++++++++++++++++++ templates/rbac.yaml | 2 +- values.yaml | 28 ++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 1 deletion(-) diff --git a/templates/configmap.yaml b/templates/configmap.yaml index 45bd809..be2e70f 100644 --- a/templates/configmap.yaml +++ b/templates/configmap.yaml @@ -92,5 +92,25 @@ data: "prometheusUrl": {{ .Values.config.netobs.prometheusUrl | default "" | quote }}, "source": {{ .Values.config.netobs.source | default "" | quote }}, "prometheusTimeout": {{ .Values.config.netobs.prometheusTimeout | default "10s" | quote }} + }, + "configMapCapture": { + "clearText": {{ .Values.config.configMapCapture.clearText | default false }}, + "captureCap": {{ .Values.config.configMapCapture.captureCap | default 4096 }}, + "redactKeyPatterns": [ + {{- range $index, $pattern := .Values.config.configMapCapture.redactKeyPatterns }} + {{- if $index }},{{ end }} + {{ $pattern | quote }} + {{- end }} + ] + }, + "envCapture": { + "clearText": {{ .Values.config.envCapture.clearText | default false }}, + "captureCap": {{ .Values.config.envCapture.captureCap | default 4096 }}, + "redactKeyPatterns": [ + {{- range $index, $pattern := .Values.config.envCapture.redactKeyPatterns }} + {{- if $index }},{{ end }} + {{ $pattern | quote }} + {{- end }} + ] } } diff --git a/templates/rbac.yaml b/templates/rbac.yaml index 90fb326..3c4e7df 100644 --- a/templates/rbac.yaml +++ b/templates/rbac.yaml @@ -7,7 +7,7 @@ metadata: {{- include "nofire-edge.labels" . | nindent 4 }} rules: - apiGroups: [""] - resources: ["pods", "services", "configmaps", "secrets", "persistentvolumeclaims", "persistentvolumes", "nodes", "namespaces", "resourcequotas", "limitranges"] + resources: ["pods", "services", "endpoints", "configmaps", "secrets", "persistentvolumeclaims", "persistentvolumes", "nodes", "namespaces", "resourcequotas", "limitranges"] verbs: ["get", "list", "watch"] - apiGroups: ["apps"] resources: ["deployments", "statefulsets", "daemonsets", "replicasets"] diff --git a/values.yaml b/values.yaml index c761e1f..3205597 100644 --- a/values.yaml +++ b/values.yaml @@ -192,6 +192,7 @@ config: - "pods" - "nodes" - "k8services" + - "endpoints" - "configmaps" - "secrets" - "persistentvolumeclaims" @@ -266,6 +267,33 @@ config: url: "" interval: "10s" + # ConfigMap value capture. Hash-by-default so raw customer configuration never + # leaves the cluster. Set clearText: true to send values verbatim (still + # subject to redactKeyPatterns and captureCap). + configMapCapture: + # false (default): every ConfigMap value is sent as a sha256 hash. + # true: values are sent in the clear, except keys matching redactKeyPatterns. + clearText: false + # In clear-text mode, ConfigMap data keys matching any of these regexes are + # hashed instead of sent verbatim (e.g. secrets embedded in a ConfigMap). + redactKeyPatterns: [] + # - "(?i)(password|passwd|secret|token|apikey|api_key|private_key)" + # Per-value byte cap for clear-text values. Values over the cap are trimmed + # (Brain is told the value was trimmed). Hashes always cover the full value. + captureCap: 4096 + + # Container env-var value capture. Hash-by-default so a plaintext credential in + # an env var never leaves the cluster. Same model as configMapCapture. + envCapture: + # false (default): every literal env value is sent as a sha256 hash. + # true: literal values are sent in the clear, except names matching redactKeyPatterns. + clearText: false + # In clear-text mode, env var names matching any of these regexes stay hashed. + redactKeyPatterns: [] + # - "(?i)(password|passwd|secret|token|apikey|api_key|private_key)" + # Per-value byte cap for clear-text values (over-cap values trimmed, flagged). + captureCap: 4096 + # Environment variables env: [] # - name: NODE_NAME From 7e8108ebfa29d20fd5c2d977d8152300d4bc58e1 Mon Sep 17 00:00:00 2001 From: stheppi Date: Tue, 11 Aug 2026 10:12:54 +0100 Subject: [PATCH 2/2] feat(chart): pin Edge to v3.6.0 and release chart 0.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The chart has never pinned an Edge version: image.tag has been "latest" since the repo was created, and appVersion sat at a stale 2.1.0 that only ever reached the app.kubernetes.io/version label. Pin it to the release whose features the rest of this branch enables. image.tag is the load-bearing edit — edge-proxy inherits it through nofire-edge.edgeProxy.image, so one value pins both deployments. The tag carries the "v" prefix because edge's release workflow computes ${GITHUB_REF#refs/tags/}, which strips refs/tags/ but not the v; the registry has nofireai/edge:v3.6.0 and no bare 3.6.0. appVersion is set to the same v-prefixed string so the tag|default .Chart.AppVersion fallback stays resolvable if anyone clears image.tag. The chart version bump is mandatory, not cosmetic: the release workflow triggers only on paths: [Chart.yaml] and skips every publish step when a release for the current version already exists. Without it this branch would merge and ship nothing. Minor rather than patch, matching the repo's feature convention (0.4.0 -> 0.5.0, 0.3.0 -> 0.4.0). Also pins the production values example, which would otherwise override the default straight back to a floating tag, and the standalone raw manifest for consistency. pullPolicy stays Always so overriding the tag back to latest still works. --- Chart.yaml | 4 ++-- examples/production-values.yaml | 2 +- manifests.yaml | 2 +- values.yaml | 6 ++++-- 4 files changed, 8 insertions(+), 6 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index e31da99..3279928 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: nofire-edge description: A Helm chart for Kubernetes Resource Graph & Causal Analysis type: application -version: 0.5.2 -appVersion: "2.1.0" +version: 0.6.0 +appVersion: "v3.6.0" keywords: - kubernetes - monitoring diff --git a/examples/production-values.yaml b/examples/production-values.yaml index 56033ed..75bdb84 100644 --- a/examples/production-values.yaml +++ b/examples/production-values.yaml @@ -2,7 +2,7 @@ image: #repository: localhost:50001/nofire-edge repository: nofireai/edge - tag: "latest" + tag: "v3.6.0" pullPolicy: Always imagePullSecrets: [] diff --git a/manifests.yaml b/manifests.yaml index c646116..ea1826b 100644 --- a/manifests.yaml +++ b/manifests.yaml @@ -19,7 +19,7 @@ spec: restartPolicy: Always containers: - name: client - image: nofireai/edge:latest + image: nofireai/edge:v3.6.0 imagePullPolicy: IfNotPresent command: ["/nofire-edge"] args: ["--config", "/etc/nofire-edge/config.json"] diff --git a/values.yaml b/values.yaml index 3205597..55681de 100644 --- a/values.yaml +++ b/values.yaml @@ -6,8 +6,10 @@ image: repository: nofireai/edge pullPolicy: Always - # Overrides the image tag whose default is the chart appVersion. - tag: "latest" + # Overrides the image tag, which otherwise defaults to the chart appVersion. + # Released tags carry the "v" prefix (nofireai/edge:v3.6.0) — a bare "3.6.0" + # does not exist in the registry. + tag: "v3.6.0" # Image pull secrets imagePullSecrets: []