Skip to content

feat: Secret references in NGINX Ingress controller annotations support#564

Draft
dabico wants to merge 2 commits intoyonahd:mainfrom
dabico:nginx
Draft

feat: Secret references in NGINX Ingress controller annotations support#564
dabico wants to merge 2 commits intoyonahd:mainfrom
dabico:nginx

Conversation

@dabico
Copy link
Contributor

@dabico dabico commented Feb 1, 2026

What this PR does / why we need it?

Take values of specific nginx.ingress.kubernetes.io annotations into consideration when performing scans of Secret resources referenced in Ingress.

PR Checklist

  • This PR adds K8s exceptions (false positives)
  • This PR adds new code
  • This PR includes tests for new/existing code
  • This PR adds docs

GitHub Issue

Closes #560

Notes for your reviewers

The current approach has a limitation: it only takes into account secret references within the same namespace. The NGINX ingress controller annotations can actually reference secrets from other namespaces. Not sure how to implement this cleanly cleanly in the current approach, while taking flags like --exclude-namespace into consideration.

@codecov-commenter
Copy link

codecov-commenter commented Feb 1, 2026

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 53.33333% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.69%. Comparing base (63151f6) to head (4eb4019).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
pkg/kor/secrets.go 53.33% 6 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #564      +/-   ##
==========================================
- Coverage   45.74%   45.69%   -0.06%     
==========================================
  Files          69       69              
  Lines        3941     3950       +9     
==========================================
+ Hits         1803     1805       +2     
- Misses       1838     1844       +6     
- Partials      300      301       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature: Recognize secret references in NGINX-specific annotations for Ingress

2 participants