[hellices]

Closes #501

Summary

The core half of slice P1 of #410: given a ConfigMap or Secret, find every Pod container in its namespace that consumes it, and how, from bounded evidence reads, keeping no configuration value. The view, the shared evidence renderer (#486) and the wiring follow in #502.

• k8s/config_references.py: one extraction of the ConfigMap and Secret references a Pod spec makes:

  • envFrom;
  • env[].valueFrom;
  • configMap, secret and projected volumes;
  • imagePullSecrets.

  It keeps the variable, key, volume and optional flag, never a value.

• Relationship graph: it now builds its USES_CONFIG facts from that extraction, in the same order and with the same field paths, so the two cannot disagree. The graph's existing tests pass unchanged.

• core/config_consumers.py: projects a Pod to its references to one object, by mode:

  • ENV_FROM and ENV_KEY;
  • VOLUME, or SUBPATH for a subPath or subPathExpr mount;
  • UNMOUNTED for a volume no container mounts;
  • IMAGE_PULL.

  Rows name the container and its category (container, init container, sidecar, ephemeral), except the Pod-level UNMOUNTED and IMAGE_PULL rows.

• core/config_propagation.py: the run. It resolves two sources from discovery and reads them together under the run token:

  • the object's metadata, by name;
  • the namespace's Pods, at the readers' maximum budgets, up to 1,000 Pods.

  Each Pod is projected at once. The report keeps both observations, the baseline and the consumers.

Departures from the design

Both are recorded in the plan:

• P1 lands in two pull requests. This one is the core; Show ConfigMap and Secret consumers with the shared evidence renderer (#410 P1, view) #502 is the view. The S6 renderer still ships with its first consumer's view.
• The shared extraction is its own k8s module rather than helpers inside relationship_facts.py, which shrinks from 1,013 to 918 lines.

Verification

• uv run pytest -p no:tach tests/k8s/test_config_references.py tests/core/test_config_consumers.py tests/core/test_config_propagation.py -q: 32 passed.
• Mutation checks: each of 11 changes was caught by a test:
  • no sidecar;
  • subPathExpr ignored;
  • no UNMOUNTED row;
  • any owner reference instead of the controller;
  • matching by name alone;
  • dropped max_pages;
  • dropped max_bytes;
  • an unresolved observation without the token;
  • consumers_conclusive always true;
  • any available object reported absent;
  • dropped expected_uid.
• uv run pytest -p no:tach tests/k8s/ tests/core/test_relationships*.py tests/ui/test_relationship* -q: 1226 passed (the graph unchanged).
• Full gate (check_source_size, ruff check, ruff format --check, mypy, tach check, pytest -n 8): 14796 passed, 39 skipped. One local failure, test_the_measured_release_is_the_installed_one: this machine's venv still has litellm 1.100.3 and cannot install the lock from behind the mirror. CI installs from the lock.

Checklist

• This closes an accepted issue in this repository that is assigned to me.
• Tests cover the change, written to fail first where behavior changed.
• make check passes locally. (Except the litellm version test above, which depends on this machine's venv.)
• User-facing docs and the README match the change, or nothing user-facing changed. (Nothing user-facing yet; the view is Show ConfigMap and Secret consumers with the shared evidence renderer (#410 P1, view) #502.)
• No security invariant is weakened: writes still need a keystroke approval
  and a fail-closed audit entry, and sensitive reads are still masked.

[Copilot]

🟢 Approved

No active review issues remain for the ConfigMap and Secret consumer diagnostics foundation.

No open issues 🎉

What changed in this PR

Adds the core foundation for ConfigMap and Secret consumer diagnostics in korvid (#501, part of #410). It identifies declared Pod consumers by consumption mode; the UI, shared evidence renderer, and wiring follow in #502.

Changes:

• Shares configuration-reference extraction with the relationship graph, preserving fact ordering and field paths.
• Projects consumers by environment, volume, subPath, unmounted-volume, and image-pull modes, including container categories.
• Adds bounded namespace-scoped evidence reads, run-token tracking, and tests for incomplete reads, absence, recreation, and exclusion of literal environment values.

File	Description
tests/​test_optional_extras.py	Checks that new modules import without optional extras.
tests/​k8s/​test_config_references.py	Covers reference forms, ordering, and malformed entries.
tests/​core/​test_config_propagation.py	Covers read budgets, evidence outcomes, tokens, and object identity.
tests/​core/​test_config_consumers.py	Covers consumption modes, container categories, and matching.
src/​korvid/​k8s/​relationship_facts.py	Uses shared extraction for configuration relationship facts.
src/​korvid/​k8s/​config_references.py	Extracts configuration references without literal environment values.
src/​korvid/​core/​config_propagation.py	Coordinates metadata and Pod reads into an evidence report.
src/​korvid/​core/​config_consumers.py	Projects Pod references into consumer rows by mode.
docs/​superpowers/​plans/​2026-10-28-config-consumers.md	Documents implementation steps, constraints, and the core/UI split.

_{Review effort: Balanced}

[my-reviewer-agent]

이슈 2건을 인라인 코멘트로 남겼습니다.

[my-reviewer-agent]

이슈 1건을 인라인 코멘트로 남겼습니다.

[my-reviewer-agent]

이슈 3건을 인라인 코멘트로 남겼습니다.

[my-reviewer-agent]

검토 범위에서 보고할 이슈가 없습니다.