Please address the comments from this code review:

## Overall Comments
- The namespace filtering logic in `GetNamespaceFilter` combined with `MatchProcessIndicator` looks like it will treat an empty filter string as a valid regex that matches all namespaces, effectively filtering out all indicators when no runtime data control is configured; consider explicitly handling the empty/`nil` config case (e.g., by returning `nil`/no regex or a regex that never matches) so that the default behavior is to *not* filter anything.
- Related to the above, `GetNamespaceFilter` assumes that `RuntimeDataControl` is present and defaults persist=true/excludeOpenshift=false; if dynamic config or its `RuntimeDataControl` is `nil`, `GetPersistence()` and `GetExcludeOpenshift()` will fall back to protobuf defaults, which may not match the intended defaults—adding explicit defaulting when `config == nil` would make this more robust.
- The new `Infof` logs for Helm config (`HelmConfigInit` and `Set HelmManagedConfigInit`) and for filtered indicators in `flushIndicatorQueue` may be too verbose/noisy at info level and could leak large or sensitive payloads; consider either dropping them or moving them to debug level and tightening the message wording (e.g., log only IDs instead of full structs).

## Individual Comments

### Comment 1
<location path="pkg/cluster/filtering.go" line_range="14" />
<code_context>
+	noPersistence   = ".*"
+)
+
+func GetNamespaceFilter(cluster *storage.Cluster) string {
+	var config *storage.DynamicClusterConfig_RuntimeDataControl
+
</code_context>
<issue_to_address>
**issue (bug_risk):** Guard against nil dynamic/Helm config to avoid panics when runtime data control is unset

This code assumes `cluster.GetDynamicConfig()`, `cluster.GetHelmConfig()`, `GetDynamicConfig()`, and `GetRuntimeDataControl()` are always non-nil. For clusters without dynamic or Helm config, dereferencing these will panic. Please add nil checks (e.g., early-return an empty filter string) before accessing nested config fields.
</issue_to_address>

### Comment 2
<location path="pkg/cluster/filtering.go" line_range="23-25" />
<code_context>
+		config = cluster.GetHelmConfig().GetDynamicConfig().GetRuntimeDataControl()
+	}
+
+	// Persistence filter has highest priority, since any other
+	// option is only its subset
+	if !config.GetPersistence() {
+		return noPersistence
+	}
</code_context>
<issue_to_address>
**issue (bug_risk):** Using an empty regex as default causes all namespaces to match and thus be filtered out

With `Persistence=true`, empty `NamespaceFilter`, and `ExcludeOpenshift=false`, `GetNamespaceFilter` returns `""`. Since `regexp.MustCompile("")` matches all strings, `MatchProcessIndicator` treats every indicator as matching and filters everything out (you only append when `!match`). This makes the "no filter" default effectively disable persistence. Please either return a never-matching regex for the empty case (e.g. `"a^"`) or treat an empty filter as "no filtering" by skipping regex/cache creation.
</issue_to_address>

### Comment 3
<location path="central/cluster/datastore/datastore_impl.go" line_range="184-185" />
<code_context>

 	for _, c := range clusters {
 		ds.idToNameCache.Add(c.GetId(), c.GetName())
+		ds.idToRegexCache.Add(c.GetId(),
+			regexp.MustCompile(clusterPkg.GetNamespaceFilter(c)))
 		ds.nameToIDCache.Add(c.GetName(), c.GetId())
 		c.HealthStatus = clusterHealthStatuses[c.GetId()]
</code_context>
<issue_to_address>
**issue (bug_risk):** Avoid panic by not using MustCompile on user-supplied regex filters

Since the namespace filter comes from user-controlled config, `regexp.MustCompile` can panic the process on invalid input, causing Central to crash-loop. Use `regexp.Compile` instead and either validate the filter at config admission time or handle errors gracefully (e.g., log and fall back to no filtering).
</issue_to_address>

### Comment 4
<location path="central/cluster/datastore/datastore_impl.go" line_range="349-354" />
<code_context>
+		return false, err
+	}
+
+	filter, ok := ds.idToRegexCache.Get(id)
+	if !ok {
+		return false, nil
+	}
+
+	return filter.(*regexp.Regexp).MatchString(indicator.GetNamespace()), nil
+}
+
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Dropping indicators on MatchProcessIndicator error can silently lose data

Because `flushIndicatorQueue` treats any non-nil error from `MatchProcessIndicator` as “don’t append”, indicators are silently dropped on error. This could occur due to regex compilation issues, cache inconsistencies, or SAC failures. Consider either treating errors as “no filtering” (still append) and/or emitting a metric so these cases are visible. Also, when the SAC check returns `ok == false` with `err == nil`, you currently return `(false, nil)`, which causes the indicator to be appended; if SAC should be enforced, `!ok` should likely be treated as an error instead.

Suggested implementation:

```golang
func (ds *datastoreImpl) MatchProcessIndicator(ctx context.Context,
	indicator *storage.ProcessIndicator) (bool, error) {
	clusterID := indicator.GetClusterId()

	// Enforce SAC: propagate errors and treat !allowed as an error so the caller
	// does not append the indicator on unauthorized access.
	allowed, err := clusterSAC.ReadAllowed(ctx, sac.ClusterScopeKey(clusterID))
	if err != nil {
		// SAC error: surface to caller (caller will NOT append on error).
		return false, err
	}
	if !allowed {
		// SAC denied with no error: treat as an explicit error so caller does not append.
		return false, errors.New("process indicator access denied by SAC")
	}

	// Look up the compiled regex for this cluster. Cache miss means no filter
	// is configured: treat as "no filtering" and allow the indicator through.
	value, ok := ds.idToRegexCache.Get(clusterID)
	if !ok {
		return true, nil
	}

	// If the cached value is not a *regexp.Regexp, treat this as an internal
	// inconsistency: emit a metric/log (elsewhere) but do not drop the indicator.
	regex, ok := value.(*regexp.Regexp)
	if !ok {
		return true, nil
	}

	// Apply the filter to the indicator's namespace.
	return regex.MatchString(indicator.GetNamespace()), nil
}

	for _, c := range clusters {

```

1. Ensure `central/cluster/datastore/datastore_impl.go` imports the `errors` and `regexp` packages if they are not already imported:
   - `import "errors"`
   - `import "regexp"`
2. To avoid silent internal failures (cache inconsistencies, bad regex, etc.), add logging and/or metrics where indicated in comments:
   - On the `!ok` type assertion branch (`if !ok { return true, nil }`), increment a counter and/or log a warning so these cases are visible operationally.
3. Verify that `flushIndicatorQueue` (or the caller) still treats `err != nil` as “do not append”, which now only occurs for SAC errors/denials; other internal issues are treated as “no filtering” and will still append.
</issue_to_address>

### Comment 5
<location path="central/sensor/service/service_impl.go" line_range="275-276" />
<code_context>

 func (s *serviceImpl) getClusterForConnection(sensorHello *central.SensorHello, serviceID *storage.ServiceIdentity) (*storage.Cluster, error) {
 	helmConfigInit := sensorHello.GetHelmManagedConfigInit()
+	log.Infof("HelmConfigInit %+v", helmConfigInit)

 	clusterIDFromCert := serviceID.GetId()
</code_context>
<issue_to_address>
**🚨 issue (security):** Logging full Helm managed config may expose sensitive information

Using `%+v` here will log the full Helm-managed configuration, which may contain sensitive or environment-specific data. Please either remove this log, restrict it to non-sensitive identifiers, or implement redaction/structured logging for any potentially sensitive fields.
</issue_to_address>