[nadaverell]

Why

A ConfigMap or Secret can look unused because Radar cannot see its consumer. For example, a workload can consume a Reflector mirror in another namespace while the audit is displaying only the source namespace. Suggesting deletion from that incomplete view is misleading.

This PR makes the unused ConfigMap/Secret check distinguish observed use, supported evidence of no use, and unknown evidence. It builds on the subject authorization and incomplete-scan presentation merged in #1753, and reuses the Reflector metadata parser from #1740. It has no remaining prerequisite on the deferred discovery work in #1750.

Behavior

Available evidence	Result
An observed supported reference uses the object	Count it as evaluated and passing, even if other consumer inventories are unavailable
No reference, with adequate readable and initially synced consumer inventories	Report the object as unused
No reference, with a required inventory unavailable or incomplete for the subject namespace	Exclude it from both findings and passing/evaluated counts; disclose incomplete reference evidence

The namespace picker selects subjects. For Reflector-annotated subjects, the collector can inspect authorized consumers of remote mirrors. Use propagates through observed same-kind links, including chains and cycles. Unused automatic mirrors with visible sources are exempt, but their existence does not establish source use.

Typed workload, ServiceAccount and Ingress inventories use the existing per-kind readiness and namespace-scope APIs. The existing dynamic reference handlers share a registry with their ConfigMap/Secret and cross-namespace requirements, so discovery and collection agree about which installed integrations matter. An installed but unsynced consumer kind is unknown, not empty. Partial discovery of a relevant group prevents an absence claim; unrelated discovery failures do not.

Cert-manager Issuer credential references cover ACME, CA, Vault and Venafi fields. ClusterIssuer credentials use the namespace established by an observed controller's explicit flag, including a literal or downward-API environment value. Hidden controllers, unresolved values or configuration files without an explicit namespace flag do not produce a guessed namespace. Explicit flags take precedence over configuration files. An authorized, synced, empty ClusterIssuer inventory needs no controller namespace.

Scope and tradeoffs

The runtime change stays in the audit collector and orphan check. It adds no shared discovery lifecycle, informer failure latch, permission grants, new watches, scan-cache redesign or coverage response schema. Existing missingInputs carries configmap-references and secret-references through REST, Home, AI context and MCP. Tests in the HTTP/MCP adapters keep their authorization assertions while explicitly supplying the core-only inventory they depend on.

Full-access users can also lose unsupported orphan findings while required inventories are still syncing. Restricted users can see fewer orphan evaluations when an installed integration can reference Secrets across namespaces. This is deliberate: an omitted unknown evaluation is preferable to an unsupported deletion suggestion. Known use still counts. The check covers supported reference fields, not arbitrary controller behavior. Existing Istio gateway workload-namespace and Contour delegated TLS resolution limitations are outside this change.

Readiness here means initial synchronization, not continuous watch freshness. The existing scan memo can lag evidence changes by up to five seconds. The per-resource audit endpoint retains its findings-array shape and has no completeness metadata; the scan and AI resource context provide that distinction. Package callers that omit ConfigReferenceEvidence can establish observed use but cannot establish absence.

Validation

• make test, make tsc, and make build passed.
• Race tests passed for pkg/audit, pkg/configrefs, and the affected audit/server/MCP scenarios.
• Live tests used the existing GitOps demo cluster with an explicit kubectl context. Local and authenticated full-access results matched exactly; Secret-denied identities disclosed missing inputs without Secret findings. Alternating and concurrent identities retained separate results.
• A temporary ConfigMap-only Reflector fixture exercised the central case. Complete visibility evaluated two subjects, with the remotely consumed source passing and the unused ConfigMap reported. A source-namespace-only cache evaluated only the unused ConfigMap and reported configmap-references for the unknown source. Configured REST, dashboard, MCP and the rendered Checks page preserved that warning.
• Live test fixtures and processes were removed. No Kubernetes grants or current-context changes. One actual embedded-UI screenshot verified the warning; no frontend source changes.

[qodo-code-review]

PR Summary by Qodo

Report incomplete audit coverage under partial Kubernetes access

🐞 Bug fix ✨ Enhancement 🧪 Tests 📝 Documentation 🕐 40+ Minutes

AI Description

• Prevents orphan findings when authorized reference evidence is incomplete or unsynchronized.
• Follows observed Reflector chains and propagates coverage gaps across all audit consumers.
• Shares scoped scans safely while withholding unreadable Secret findings, counts, and names.

Diagram

graph TD
  A["Authenticated Callers"] --> B["Read Scope"] --> C["Scan Memo"] --> D["Evidence Snapshot"] --> E{"Coverage Complete"}
  E -->|Yes| F["Orphan Findings"] --> H["Consumer Surfaces"]
  E -->|No| G["Coverage Rows"] --> H

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Disable the entire orphan check on any gap

• ➕ Simpler completeness model and response contract
• ➕ Eliminates all false-positive orphan findings under partial evidence
• ➖ Suppresses valid findings from unaffected kinds and namespaces
• ➖ Provides less actionable detail about the missing evidence

2. Issue fresh API lists for every audit

• ➕ Avoids relying on potentially stale informer stores
• ➕ Can evaluate permissions directly for each request
• ➖ Adds API-server load and request latency
• ➖ Complicates consistency across many typed and dynamic resources
• ➖ Still requires careful partial-failure and authorization handling

3. Preserve best-effort negative findings

• ➕ Maintains previous result volume and simpler evaluation behavior
• ➕ Requires fewer API and UI changes
• ➖ Can incorrectly label resources unused
• ➖ May leak information through Secret counts or cached cross-user results
• ➖ Presents empty findings as an unsafe all-clear

Recommendation: Keep the PR's per-kind, per-namespace evidence snapshot and conservative negative-finding policy. It preserves known-use conclusions and unaffected findings while preventing false orphan reports; scoped memoization offsets the additional collection cost, and explicit coverage rows make uncertainty visible without exposing restricted inventory.

Files changed (44) +1675 / -266

Enhancement (16) +447 / -35

diagnoser.goPreserve incomplete audit context in AI diagnosis +4/-0

Preserve incomplete audit context in AI diagnosis

• Adds an audit-incomplete health signal and instructs diagnosis prompts not to interpret skipped checks as passing or deletion safety.

internal/ai/diagnoser.go

scope.goResolve authorization scope and scan identity +116/-0

Resolve authorization scope and scan identity

• Adds namespace, Secret, and cluster-resource authorization modeling. Generates stable scan keys incorporating selected namespaces, permissions, discovery dependencies, and informer readiness.

internal/audit/scope.go

summary.goInclude incomplete coverage in resource summaries +12/-3

Include incomplete coverage in resource summaries

• Uses the shared scoped scan memo and marks a resource audit summary incomplete when matching coverage rows exist.

internal/auditcontext/summary.go

tools_audit.goExpose bounded coverage through MCP audits +15/-11

Expose bounded coverage through MCP audits

• Runs caller-scoped cached audits and returns coverage rows alongside findings. Caps coverage at 50 rows and reports whether additional rows were omitted.

internal/mcp/tools_audit.go

ai_diagnose.goAdd scoped coverage state to AI health signals +2/-1

Add scoped coverage state to AI health signals

• Uses request-aware audit summaries and forwards incomplete coverage into AI diagnosis health context.

internal/server/ai_diagnose.go

dashboard.goReport incomplete audit status on the dashboard +6/-3

Report incomplete audit status on the dashboard

• Runs the dashboard audit with caller scope and exposes an incomplete flag whenever coverage gaps remain.

internal/server/dashboard.go

AuditCard.tsxRender incomplete dashboard audits as unknown +10/-7

Render incomplete dashboard audits as unknown

• Adds an unknown severity state and replaces all-passing messaging with neutral incomplete-coverage language when no findings are available.

packages/k8s-ui/src/components/audit/AuditCard.tsx

ChecksView.tsxDistinguish incomplete empty audit results +5/-4

Distinguish incomplete empty audit results

• Adds an incomplete input and displays a neutral empty state instead of claiming every resource passed.

packages/k8s-ui/src/components/checks/ChecksView.tsx

coverage.goDefine audit coverage contracts and aggregation +60/-0

Define audit coverage contracts and aggregation

• Introduces coverage reasons, per-check coverage rows, reference snapshots, and skipped-subject aggregation for the orphan check.

pkg/audit/coverage.go

helpers.goFilter coverage with audit settings +7/-0

Filter coverage with audit settings

• Applies ignored namespace and disabled-check settings to coverage rows alongside findings and evaluation counts.

pkg/audit/helpers.go

types.goExpose reference snapshots and coverage results +5/-6

Expose reference snapshots and coverage results

• Extends audit inputs and outputs with ConfigReferenceSnapshot and coverage rows. Reuses the shared config-reference identity type.

pkg/audit/types.go

reflector.goParse and traverse EmberStack Reflector topology +105/-0

Parse and traverse EmberStack Reflector topology

• Adds metadata-only reflection parsing between observed same-kind endpoints. Tracks automatic and unresolved mirrors and propagates consumer use backward through renamed chains and cycles.

pkg/configrefs/reflector.go

evidence.goExpose informer evidence health and scope +78/-0

Expose informer evidence health and scope

• Classifies watch termination errors, reports typed and dynamic watch failures, enumerates dynamic readiness states, and identifies incomplete namespace coverage.

pkg/k8score/evidence.go

types.goAdd incomplete state to resource audit summaries +1/-0

Add incomplete state to resource audit summaries

• Extends resource context responses with an optional incomplete audit indicator.

pkg/resourcecontext/types.go

client.tsType audit coverage API responses +10/-0

Type audit coverage API responses

• Adds the coverage row and reason union types and exposes coverage and missing inputs on audit responses.

web/src/api/client.ts

AuditView.tsxDisplay audit coverage gaps in the main view +11/-0

Display audit coverage gaps in the main view

• Summarizes skipped checks, distinguishes watch failures from other gaps, recommends reconnecting when needed, and prevents incomplete empty results from appearing healthy.

web/src/components/audit/AuditView.tsx

Bug fix (13) +519 / -217

coverage.goCollect scoped reference evidence and coverage state +254/-0

Collect scoped reference evidence and coverage state

• Builds ConfigMap and Secret reference snapshots from authorized typed and dynamic inventories. Tracks synchronization, discovery, scope, watch failures, reflection coverage, and unavailable subjects by kind and namespace.

internal/audit/coverage.go

crd_config_refs.goModel and filter dynamic reference dependencies +59/-122

Model and filter dynamic reference dependencies

• Replaces the handler switch with dependency metadata describing ConfigMap support and cross-namespace behavior. Filters dynamic objects by caller scope, synchronization, and watch health before collecting references.

internal/audit/crd_config_refs.go

runner.goApply read scope before running audit checks +32/-6

Apply read scope before running audit checks

• Restricts subject namespaces and Secrets before evaluation, attaches the new reference snapshot, and treats lister failures as unavailable inventory instead of empty inventory.

internal/audit/runner.go

audit_scope.goBuild caller-specific MCP audit options +22/-0

Build caller-specific MCP audit options

• Resolves namespace, Secret, and cluster-scoped reference permissions from the MCP request context for scoped audits.

internal/mcp/audit_scope.go

resource_context.goScope MCP resource audit summaries +2/-2

Scope MCP resource audit summaries

• Passes request-derived audit options into per-resource summary generation.

internal/mcp/resource_context.go

tools.goPropagate MCP request context to audit summaries +1/-1

Propagate MCP request context to audit summaries

• Updates resource-context construction to compute audit summaries using the active caller context.

internal/mcp/tools.go

ai_handlers.goScope AI resource audit context by caller +5/-5

Scope AI resource audit context by caller

• Converts audit summary helpers into server methods so request authorization is applied to AI resource context and diagnosis rows.

internal/server/ai_handlers.go

audit_handlers.goUse shared scoped scans in audit endpoints +2/-38

Use shared scoped scans in audit endpoints

• Replaces the server-local namespace-only cache with the shared identity-aware audit memo for list and resource endpoints.

internal/server/audit_handlers.go

audit_scope.goBuild request-specific server audit scope +22/-0

Build request-specific server audit scope

• Derives authorized namespaces, Secret list access, and cluster-scoped dynamic grants for server audit calls.

internal/server/audit_scope.go

namespace_scope.goInvalidate audit scans after context switches +2/-0

Invalidate audit scans after context switches

• Clears memoized audit results when cluster or namespace context changes.

internal/server/namespace_scope.go

checks.goRequire complete evidence for orphan findings +89/-29

Require complete evidence for orphan findings

• Consumes explicit reference snapshots, propagates use through reflection chains, exempts unused automatic mirrors, and records skipped coverage rather than treating unknown objects as passing. Adds reusable typed reference collection.

pkg/audit/checks.go

cache.goLatch invalidating typed informer failures +13/-11

Latch invalidating typed informer failures

• Records when a post-sync typed informer watch error makes cached evidence unreliable while preserving existing diagnostics.

pkg/k8score/cache.go

dynamic_cache.goTrack invalidating dynamic watch failures +16/-3

Track invalidating dynamic watch failures

• Installs dynamic informer watch-error handlers that latch evidence unavailability after synchronization while retaining default error handling.

pkg/k8score/dynamic_cache.go

Tests (12) +607 / -14

diagnoser_test.goTest incomplete audit diagnosis framing +11/-0

Test incomplete audit diagnosis framing

• Verifies incomplete coverage appears in the health frame without being treated as an active health issue.

internal/ai/diagnoser_test.go

coverage_test.goTest audit evidence scope and readiness handling +188/-0

Test audit evidence scope and readiness handling

• Covers cross-namespace evidence, Secret authorization, dynamic inventory synchronization, namespace authority, list failures, partial discovery, and dependency-domain isolation.

internal/audit/coverage_test.go

crd_config_refs_test.goValidate dynamic ConfigMap dependency metadata +5/-0

Validate dynamic ConfigMap dependency metadata

• Ensures every handler producing ConfigMap references is marked as a ConfigMap dependency for coverage calculations.

internal/audit/crd_config_refs_test.go

memo_test.goTest scan memo isolation and invalidation +45/-0

Test scan memo isolation and invalidation

• Verifies reuse for identical scans, separation between Secret permission scopes, explicit invalidation, and isolation across cluster cache replacement.

internal/audit/memo_test.go

audit_scope_test.goTest MCP authorization and coverage bounds +70/-0

Test MCP authorization and coverage bounds

• Verifies unreadable Secrets do not affect MCP findings or counts and confirms coverage output is capped at 50 rows with truncation indicated.

internal/mcp/audit_scope_test.go

audit_raw_test.goUpdate raw audit tests for shared memo invalidation +2/-3

Update raw audit tests for shared memo invalidation

• Invalidates the centralized audit scan memo when test settings change.

internal/server/audit_raw_test.go

audit_scope_test.goTest server audit cache authorization isolation +53/-0

Test server audit cache authorization isolation

• Confirms users without Secret list permission receive no Secret findings, evaluated counts, or hidden inventory counts, without contaminating authorized cached scans.

internal/server/audit_scope_test.go

checks_test.goProvide explicit complete evidence to orphan tests +9/-9

Provide explicit complete evidence to orphan tests

• Updates existing orphan fixtures to declare complete reference coverage before expecting negative unused-resource findings.

pkg/audit/checks_test.go

coverage_test.goTest conservative orphan and reflection coverage behavior +79/-0

Test conservative orphan and reflection coverage behavior

• Verifies unknown evidence does not produce findings or passes, known references still prove use, reflection coverage gates source findings, and settings filter coverage rows.

pkg/audit/coverage_test.go

reflector_test.goTest Reflector identity, chains, and cycles +47/-0

Test Reflector identity, chains, and cycles

• Covers renamed mirrors, deterministic topology, automatic-mirror behavior, malformed annotations, missing endpoints, and cycle-safe use propagation.

pkg/configrefs/reflector_test.go

cache_test.goUpdate typed watch-error tests for sync state +2/-2

Update typed watch-error tests for sync state

• Passes pre-sync status explicitly into existing watch-error recording tests.

pkg/k8score/cache_test.go

evidence_test.goTest evidence failure classification and recovery +96/-0

Test evidence failure classification and recovery

• Verifies normal watch closures do not invalidate evidence, startup failures can recover, and post-sync authorization failures remain latched until cache recreation.

pkg/k8score/evidence_test.go

Documentation (2) +34 / -0

configuration.mdDocument partial-access audit coverage semantics +29/-0

Document partial-access audit coverage semantics

• Explains how selected namespaces differ from evidence scope, when orphan coverage becomes incomplete, and how informer failures affect authority. Documents the snapshot requirement for library callers and Reflector behavior.

docs/configuration.md

mcp.mdDocument MCP audit coverage reporting +5/-0

Document MCP audit coverage reporting

• Describes coverage rows, the 50-row MCP limit, truncation signaling, and why empty findings with gaps are not an all-clear.

docs/mcp.md

Other (1) +68 / -0

memo.goAdd shared identity-aware audit scan memo +68/-0

Add shared identity-aware audit scan memo

• Introduces a five-second memo shared by audit consumers and keyed by cache identity, authorization scope, options, discovery, and inventory readiness. Supports explicit invalidation and guards against state changes during scans.

internal/audit/memo.go

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Hosted audits falsely show all-clear ✓ Resolved 🔗 Cross-repo conflict ≡ Correctness

Description

ScanResults.Coverage is new, but Radar Hub's radarAuditScan omits it and propagates only
MissingInputs to Radar Hub Web. When partial access produces no findings and coverage gaps without
missing inputs, the fleet dashboard reaches its healthy “All checks clear” state instead of
reporting incomplete coverage.

Code

pkg/audit/types.go[117]

+	Coverage []CheckCoverage      `json:"coverage,omitempty"`

Relevance

●●● Strong

Coverage is explicitly intended to propagate through audit consumers; omitting it creates a false
healthy state.

PR-#1513

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Radar adds and populates a separate coverage field for skipped audit subjects. Radar Hub's scan DTO
has no corresponding field and forwards only missing inputs, while Radar Hub Web bases its
partial-coverage state exclusively on missing inputs and otherwise selects healthy all-clear
messaging.

pkg/audit/types.go[114-125]
pkg/audit/checks.go[1656-1659]
External repo: skyhook-dev/radar-hub, internal/server/fleet_handlers.go [1051-1063]
External repo: skyhook-dev/radar-hub, internal/server/fleet_handlers.go [1192-1208]
External repo: skyhook-dev/radar-hub-web, src/pages/home/dashboardData.ts [188-220]
External repo: skyhook-dev/radar-hub-web, src/pages/home/PostureCards.tsx [219-245]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Radar now reports incomplete audit evidence through `ScanResults.coverage`, but Radar Hub silently drops that field and Radar Hub Web consequently treats an incomplete scan with no findings as an all-clear. Coordinate updates so the hosted fleet contract preserves and displays the new coverage state while remaining compatible with older agents.
## Fix Focus Areas
- pkg/audit/types.go[116-121]
- /cross_repos/radar-hub/internal/server/fleet_handlers.go[1051-1063]
- /cross_repos/radar-hub-web/src/pages/home/PostureCards.tsx[219-245]
## Recommended Fix
Add the optional coverage rows to Radar Hub's raw scan DTO and fleet response, propagate them per cluster, and aggregate them into an incomplete signal in Radar Hub Web. Use that signal alongside `missingInputs` when selecting the checks card accent and all-clear wording; treat absent coverage from older agents as the legacy behavior.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Custom issuer secrets look unused ✓ Resolved 🐞 Bug ≡ Correctness

Description

collectConfigEvidence leaves clusterIssuerNamespaces unknown whenever deployment evidence is not
cluster-wide, but dynamic reference extraction independently falls back to the hard-coded
cert-manager namespace. When cert-manager uses a custom cluster-resource namespace that is visible
to the audit but its controller Deployment is outside the caller's scope, coverage can be considered
complete while the valid ClusterIssuer Secret reference is omitted and the Secret reaches the
orphan finding path.

Code

internal/audit/coverage.go[R182-184]

+	if evidence.Deployments != nil && typedCoverage(cache, "deployments", "").Complete && (scope == nil || scope.Namespaces == nil) {
+		deps.clusterIssuerNamespaces = certManagerClusterResourceNamespaces(evidence.Deployments)
+	}

Relevance

●●● Strong

Accepted precedent directly flags hard-coded ClusterIssuer namespace attribution causing omitted
Secret references.

PR-#1067

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The authoritative namespace is only recorded with cluster-wide Deployment coverage, but the
extraction context derives its own value from scoped Deployments and defaults to cert-manager when
none are found. Per-namespace coverage does not skip the ClusterIssuer dependency when the
authoritative namespace remains unknown, allowing the omitted reference to become a negative orphan
conclusion.

internal/audit/coverage.go[182-186]
internal/audit/coverage.go[101-133]
internal/audit/crd_config_refs.go[84-100]
internal/audit/crd_config_refs.go[281-290]
internal/audit/crd_config_refs.go[688-717]
pkg/audit/checks.go[1010-1035]
pkg/audit/checks.go[1078-1088]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A scoped audit can treat ClusterIssuer evidence as complete while reference extraction assumes the default cert-manager namespace, producing false orphan findings for Secrets in a custom cluster-resource namespace.
## Fix Focus Areas
- internal/audit/coverage.go[182-218]
- internal/audit/crd_config_refs.go[84-100]
- internal/audit/crd_config_refs.go[281-290]
- internal/audit/crd_config_refs.go[688-717]
## Recommended Fix
Use one shared cluster-resource namespace result for both coverage and reference extraction. If the namespace cannot be established from authoritative deployment evidence, mark affected Secret reference coverage incomplete rather than falling back to the default namespace; otherwise pass the derived namespace explicitly into ClusterIssuer extraction.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Cluster audits ignore user grants ✓ Resolved 🐞 Bug ⛨ Security

Description

RunFromCache applies the new ReadScope only by intersecting namespaces, then runs the dynamic
Crossplane scan without consulting ClusterResources or the caller's list permission for each
watched resource. For a namespace-limited identity, HTTP audit responses include denied
cluster-scoped findings, while MCP's namespace-only post-filter removes the same findings even when
that identity has permission to list them.

Code

internal/audit/runner.go[R38-39]

+	if scope != nil {
+		namespaces = scope.subjectNamespaces(namespaces)

Relevance

●● Moderate

Concrete authorization gap, but no closely matching precedent confirms team acceptance of this
dynamic-scan behavior.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new scope is reduced to a namespace list before the existing dynamic scan runs, while that scan
deliberately retains objects with an empty namespace and turns them into audit subjects. The server
returns those results without a cluster-resource authorization pass, whereas MCP drops all
empty-namespace findings based only on its namespace allow-list.

internal/audit/runner.go[31-67]
internal/audit/runner.go[133-173]
internal/audit/scope.go[21-33]
internal/server/audit_handlers.go[64-92]
internal/mcp/tools_audit.go[100-111]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Cluster-scoped dynamic audit subjects are collected without applying the authenticated caller's resource grants, causing denied findings to appear through HTTP and authorized findings to disappear through MCP.
## Fix Focus Areas
- internal/audit/runner.go[31-76]
- internal/audit/runner.go[133-176]
- internal/audit/scope.go[13-50]
- internal/mcp/tools_audit.go[100-111]
## Recommended Fix
Pass the read scope into dynamic subject collection and authorize each cluster-scoped watched GVR before including its objects. Represent grants for every cluster-scoped dynamic audit source, not only config-reference handlers, and replace MCP's blanket empty-namespace rejection with the same resource-grant decision.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Two reference comments narrate loops ✓ Resolved 📘 Rule violation ⚙ Maintainability

Description

CollectConfigObjectRefs adds comments that merely label the referenced-name initialization and the
Ingress TLS iteration performed immediately below them. Removing these comments leaves the intent
unchanged and prevents later readers from mistaking narration for an additional constraint.

Code

pkg/audit/checks.go[1968]

+	// Build set of referenced ConfigMap and Secret names (namespace/name)

Relevance

●●● Strong

New comments restate immediately visible initialization and loop behavior, matching the stated
repository rule.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Rule 3036542 prohibits newly added comments that only restate obvious behavior. The comment at line
1968 labels maps and loops that visibly collect ConfigMap and Secret names, while line 1985 labels
the immediately following Ingress TLS secret loop.

Rule 3036542: Avoid explanatory comments that restate obvious code behavior
pkg/audit/checks.go[1968-1974]
pkg/audit/checks.go[1985-1992]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Two comments in `CollectConfigObjectRefs` only restate the behavior of the code immediately below them and provide no rationale, constraint, or invariant.
## Fix Focus Areas
- pkg/audit/checks.go[1968-1968]
- pkg/audit/checks.go[1985-1985]
## Recommended Fix
Remove both explanatory comments while leaving the reference collection logic unchanged.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 85ea382. Configure here.}