fix: improve ConfigMap usage detection for sidecar patterns #1602
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📑 Description
This PR fixes false positive reports from the ConfigMap analyzer when ConfigMaps are dynamically loaded by sidecar containers.
Problem:
The current analyzer only detects ConfigMaps directly referenced in Pod specs (
volumes,env,envFrom). However, many operators (Grafana, Prometheus, Fluentd) use sidecar containers that load ConfigMaps dynamically via label selectors and Kubernetes API watches, causing false "unused" reports.Solution:
Added detection for common sidecar patterns:
grafana_dashboardlabel (Grafana dashboard sidecar)grafana_datasourcelabel (Grafana datasource sidecar)prometheus_rulelabel (Prometheus Operator)fluentd_configlabel (Fluentd config reloader)k8sgpt.ai/dynamically-loadedlabel for custom patternsk8sgpt.ai/skip-usage-checkannotation✅ Checks
ℹ Additional Information
Backward compatibility:
✅ No breaking changes - existing detection logic fully preserved, new features are opt-in or based on well-known community labels.
Unit Test Passed:
$ go test -v ./pkg/analyzer -run TestConfigMap === RUN TestConfigMapAnalyzer === RUN TestConfigMapAnalyzer/unused_configmap === RUN TestConfigMapAnalyzer/empty_configmap === RUN TestConfigMapAnalyzer/large_configmap === RUN TestConfigMapAnalyzer/used_configmap --- PASS: TestConfigMapAnalyzer (0.00s) --- PASS: TestConfigMapAnalyzer/unused_configmap (0.00s) --- PASS: TestConfigMapAnalyzer/empty_configmap (0.00s) --- PASS: TestConfigMapAnalyzer/large_configmap (0.00s) --- PASS: TestConfigMapAnalyzer/used_configmap (0.00s) === RUN TestConfigMapAnalyzer_SidecarPatterns === RUN TestConfigMapAnalyzer_SidecarPatterns/grafana_dashboard_configmap_should_not_be_flagged_as_unused === RUN TestConfigMapAnalyzer_SidecarPatterns/configmap_with_skip_annotation_should_be_ignored === RUN TestConfigMapAnalyzer_SidecarPatterns/normal_unused_configmap_should_still_be_flagged === RUN TestConfigMapAnalyzer_SidecarPatterns/prometheus_rule_configmap_should_not_be_flagged === RUN TestConfigMapAnalyzer_SidecarPatterns/custom_dynamically-loaded_label_should_work --- PASS: TestConfigMapAnalyzer_SidecarPatterns (0.00s) --- PASS: TestConfigMapAnalyzer_SidecarPatterns/grafana_dashboard_configmap_should_not_be_flagged_as_unused (0.00s) --- PASS: TestConfigMapAnalyzer_SidecarPatterns/configmap_with_skip_annotation_should_be_ignored (0.00s) --- PASS: TestConfigMapAnalyzer_SidecarPatterns/normal_unused_configmap_should_still_be_flagged (0.00s) --- PASS: TestConfigMapAnalyzer_SidecarPatterns/prometheus_rule_configmap_should_not_be_flagged (0.00s) --- PASS: TestConfigMapAnalyzer_SidecarPatterns/custom_dynamically-loaded_label_should_work (0.00s) PASS ok github.com/k8sgpt-ai/k8sgpt/pkg/analyzer 6.097sCluster verification (kube-prometheus-stack deployed)
Before fix:
After fix:
==> Verification of ConfigMap labels
Result: ✅ 29 false positives eliminated (97% reduction)
Files changed:
pkg/analyzer/configmap.go: AddedisKnownSidecarPattern()andshouldSkipUsageCheck()helper functionspkg/analyzer/configmap_test.go: AddedTestConfigMapAnalyzer_SidecarPatternswith 5 test cases