Description
Found by lane L10 while fixing the annotation leak, 2026-08-27.
--include-secret-data and --include-configmap-data are declared on CaptureOpts (internal/capture/collector.go:11-12), exposed as CLI flags, documented in docs/tools.md, and have an entire opt-in deploy/skcapture/rbac-secrets.yaml built around them. Nothing reads either field. A grep for both names across internal/ and cmd/ returns only the declaration and the assignment from the flag. No collector fetches Secret or ConfigMap data.
Why this is worse than dead code: the documentation and a shipped RBAC file describe a capability that does not exist. An operator reasoning about what skcapture might read — which is exactly the reasoning the zero-secret posture asks them to do — is reasoning about a surface that is not there. And an operator who applies rbac-secrets.yaml grants real Secret access to a binary that will never use it, which is a strictly worse security position than not applying it.
Either implement the flags or remove them, the flags, the docs and the RBAC file together. Removing is the smaller change and matches what the tool actually does; implementing means deciding what a capture is for, since inventory shape rarely needs secret VALUES.
Note the interaction with SKT-0012.09: that task proposes a narrow, named-resource ConfigMap get for the collector identity, which is a different and much smaller grant than rbac-secrets.yaml. Do not conflate them.
Acceptance Criteria
- #1 The flags either work or are gone
- #2 docs/tools.md describes only what the tool actually does
- #3 No shipped RBAC file grants access the binary never uses
- #4 If removed, the removal is stated in the docs so an operator who relied on the flag is not silently surprised
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
2026-09-06 execution: remove the inert secret/configmap-data flags, truthful docs, and unused rbac-secrets grant together; validate the public CLI and deployment surface.
Implementation Notes
2026-09-06 implementation: removed the inert –include-secret-data and –include-configmap-data flags, deleted rbac-secrets.yaml, and corrected all operator documentation to state that skcapture never captures Secret or arbitrary ConfigMap values. The separate named-ConfigMap identity grant belongs only to SKT-0012.09 and does not grant Secret access. CLI, documentation, RBAC, Helm, environment, full local, dump, and e2e checks passed.
Final Summary
2026-09-06: Done. Removed both non-functional data flags and the RBAC file that promised an absent capability; documentation now states the real zero-secret behavior and calls out the removal for existing operators.