[nadaverell]

Radar read Traefik's TLS references from the wrong fields. A ServersTransportTCP's CA and client certificates, and the CA ConfigMaps or Secrets a transport names under rootCAs, never appeared in topology or the resource drawer. The audit reads the same fields, so it could report those Secrets and ConfigMaps as unused, which invites deleting live TLS material. Radar also drew an IngressRoute's tls.store as configuration, although Traefik ignores it.

What changed

One helper, configrefs.TraefikTransportRefs, reads what Traefik reads; topology and the audit both use it:

• ServersTransport (traefik.io): spec.rootCAs[] (a Secret or a ConfigMap), the deprecated spec.rootCAsSecrets, and spec.certificatesSecrets.
• ServersTransportTCP: the same fields under spec.tls. Radar read them from spec, where the TCP kind has none.
• A rootCAs entry that names both a Secret and a ConfigMap is skipped, as Traefik's provider does.
• TLSStore: spec.certificates[].secretName as well as spec.defaultCertificate, through configrefs.TraefikTLSStoreSecrets.

In topology, these become ConfigMap/Secret → transport and Secret → TLSStore configures edges. A transport's CA ConfigMap gets a stub node when it isn't otherwise shown, as its Secrets already do. The drawer lists them under Configuration.

In the audit, traefik.io ServersTransport and ServersTransportTCP now count as ConfigMap consumers. Only that group has rootCAs, so the legacy traefik.containo.us group does not.

tls.store is no longer drawn. Traefik serves every route from the default TLSStore and never reads a route's store reference: its own field comment says only default can be used, and getTLSHTTP/getTLSTCP ignore it. The drawer's TLS section still shows the field as written.

Result on a live cluster

Traefik 3.7.14 on EKS: a ServersTransportTCP with spec.tls.rootCAs (a ConfigMap) and certificatesSecrets, a default TLSStore with an extra certificate, and an IngressRoute naming that store.

• The transport lists its CA ConfigMap and client Secret under Configuration, and its TCP route under Used By.
• The TLSStore lists both certificate Secrets.
• The route no longer shows the TLSStore.
• The audit no longer reports those Secrets or the ConfigMap as unused.
• Traefik resolved all of them: its log reports missing TLS Secrets for another fixture and nothing for these.

Testing

• Helper tests: HTTP vs TCP nesting, rootCAs Secret, ConfigMap and both-set entries, and TLSStore certificates.
• TestTraefikTLSMaterialEdgesFollowTraefiksFields for every edge, plus the absence of the TLSStore → route edge and of a top-level field on a TCP transport.
• Audit cases for TCP transports and TLSStore certificates.
• Each test fails with its fix reverted. make test passes. Two timing-sensitive tests in unrelated packages (cmd/desktop, internal/ai) timed out once under load and pass on rerun.
• Expectation changes: TestProjectionConfigurationDirection no longer expects the TLSStore → IngressRoute edge. An audit fixture wrote certificatesSecrets as [{name: …}]; every Traefik version declares it a string list, so the fixture now uses strings.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Read Traefik TLS references from the fields Traefik uses

🐞 Bug fix 🧪 Tests 🕐 20-40 Minutes

AI Description

• Read transport CA and client certificates, including TCP TLS fields and ConfigMap-backed CAs.
• Show TLSStore certificates in topology and protect referenced TLS material from unused-resource
 audit findings.
• Remove route-to-TLSStore edges because Traefik ignores the route's store reference.

Diagram

graph TD
  transports["ServersTransport CRDs"] --> refs["Shared TLS refs"] --> topology["Topology builder"] --> drawer["Resource drawer"]
  stores["TLSStore CRDs"] --> refs
  refs --> audit["Unused-resource audit"]

Loading

High-Level Assessment

Keep the shared extraction helper: topology and audit must interpret Traefik's TLS fields consistently. Separate parsing in each consumer would risk recreating the discrepancy this PR fixes.

Files changed (7) +284 / -68

Bug fix (3) +156 / -66

crd_config_refs.goCount Traefik TLS material as referenced in the audit +18/-7

Count Traefik TLS material as referenced in the audit

• Uses shared extractors for transport and TLSStore Secrets, including TCP's nested TLS fields and additional TLSStore certificates. Enables ConfigMap consumption for traefik.io transports while leaving the legacy group's ConfigMap setting unchanged.

internal/audit/crd_config_refs.go

traefik.goCentralize Traefik transport and TLSStore reference extraction +73/-0

Centralize Traefik transport and TLSStore reference extraction

• Adds helpers that read HTTP transport fields from spec, TCP transport fields from spec.tls, and both TLSStore certificate sources. They deduplicate references and skip rootCAs entries that name both a Secret and a ConfigMap.

pkg/configrefs/traefik.go

builder.goDraw actual Traefik TLS dependencies +65/-59

Draw actual Traefik TLS dependencies

• Uses the shared helpers to create Secret and ConfigMap configuration edges for transports and certificate Secret edges for TLSStores, creating missing resource nodes when needed. Removes route-to-TLSStore edges because Traefik ignores a route's tls.store reference.

pkg/topology/builder.go

Tests (4) +128 / -2

crd_config_refs_test.goCover TCP transport and TLSStore audit references +18/-1

Cover TCP transport and TLSStore audit references

• Adds cases for TCP CA ConfigMaps and Secrets, client certificates, and additional TLSStore certificates. Corrects an existing certificatesSecrets fixture to use string entries.

internal/audit/crd_config_refs_test.go

traefik_test.goTest Traefik TLS reference extraction +37/-0

Test Traefik TLS reference extraction

• Checks HTTP versus TCP field nesting, Secret and ConfigMap CAs, ambiguous entries, and deduplication of transport and TLSStore references.

pkg/configrefs/traefik_test.go

projection_labels_test.goDrop the obsolete route-to-TLSStore edge expectation +1/-1

Drop the obsolete route-to-TLSStore edge expectation

• Adjusts the configuration-direction test so it no longer expects a TLSStore to configure an IngressRoute through tls.store.

pkg/topology/projection_labels_test.go

traefik_transport_test.goVerify Traefik TLS topology edges +72/-0

Verify Traefik TLS topology edges

• Adds an integration-style topology test for HTTP and TCP transport TLS material and both TLSStore certificate sources. It also asserts that a TCP top-level certificate field and a route's tls.store do not produce edges.

pkg/topology/traefik_transport_test.go

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗