Motivation:
HelmChart.AsHelmArgs() appends ReleaseName as the first bare
positional argument to `helm template`, and pullCommand() appends
Name as a bare positional argument to `helm pull` (when a repo is
set and the chart isn't already cached locally). Neither value is
preceded by a `--` delimiter before being handed to exec.Command.
Helm's own flag parser does not distinguish a bare positional
argument from a flag: if a kustomization.yaml sets, for example,
releaseName: --post-renderer=./evil.sh, helm interprets that as a
--post-renderer flag rather than a release name, and executes the
attacker-supplied script during `kustomize build --enable-helm`
(or `kubectl kustomize --enable-helm`). This is a real,
demonstrated flag-injection path reachable from an untrusted
kustomization.yaml plus --enable-helm; it is not a claim about
every possible helm argument, only the two fields that are passed
as bare positionals. Other HelmChart fields (Namespace, ValuesFile,
KubeVersion, etc.) are passed as `--flag value` pairs, where helm's
pflag-based parser consumes the very next token as the flag's value
regardless of its content, so they are not exploitable the same way
and are out of scope for this change.
Approach:
Reject a releaseName or name that starts with '-' in validateArgs(),
which runs during Config() before any helm subprocess is spawned.
The check is added to the plugin source
(plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator.go)
and mirrored into the generated copy
(api/internal/builtins/HelmChartInflationGenerator.go) via
`go generate .` (pluginator), matching how this plugin is normally
maintained. A small test harness helper,
ErrorFromLoadAndRunGenerator, was added to
api/testutils/kusttest/harnessenhanced.go, modeled on the existing
ErrorFromLoadAndRunTransformer helper, so the new tests can assert
on the Config()-time validation error without needing an actual
helm binary installed.
Validation:
- `cd api && go build ./... && go vet ./...` pass.
- `cd plugin/builtin/helmchartinflationgenerator && go vet ./...`
passes. (`go build ./...` in that directory fails with "function
main is undeclared" both before and after this change; it's a
//go:generate pluginator source file compiled specially, not a
standalone main package, so plain `go build` there is not
meaningful.)
- Added TestHelmChartInflationGeneratorRejectsFlagLikeReleaseName
and TestHelmChartInflationGeneratorRejectsFlagLikeChartName in
plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator_test.go.
Verified both fail-then-pass: with each new HasPrefix check
temporarily removed, `go test ./... -run
TestHelmChartInflationGeneratorRejectsFlagLike... -v` fails with
an "unable to run: helmV3 ... executable file not found" error,
proving execution reaches the real helm subprocess call with the
injected flag; restoring the check makes the same test pass with
the expected "must not start with '-'" error, confirming
validation now happens before any subprocess is spawned.
- `go test ./types/... ./testutils/... ./internal/builtins/...` in
api/ pass. `go test ./krusty/...` has one unrelated pre-existing
failure, TestAddManagedbyLabel, which fails identically on
unmodified master: it expects a version string baked in via
-ldflags during `make test` that plain `go test` does not set.
- golangci-lint v1.64.8 (the version pinned in hack/go.mod, matching
what CI's `make lint` installs) run against the changed packages
is clean.
Report: https://github.com/kubernetes-sigs/kustomize/issues/6241
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5 (via Claude Code)
The default images field spec covers spec/volumes[]/image/reference
under Pod and PodTemplateSpec, but CronJob's Image Volume under
spec/jobTemplate/spec/template/spec was missing from the list. This
adds the missing path.
IsImageMatched interpolates the image name from kustomization images[].name
straight into a regexp and discarded the compile error. When the name is not
a valid regexp (for example "["), regexp.Compile returns a nil *Regexp and
the following MatchString call dereferences it, so kustomize build crashes with
a SIGSEGV.
Capture the compile error and return false when it is set. A name that can't
compile matches no image, which leaves the resource untouched (the same result
you get for any name that doesn't match). Adds a unit test for the invalid name
and a krusty end-to-end case that builds without panicking.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
* fix: match image digests with any algorithm, not only sha256
IsImageMatched hard-coded '@sha256:' in its regex, while Split accepts any
digest algorithm. An image pinned with a non-sha256 digest (e.g.
nginx@sha512:...) was not matched, so the ImageTagTransformer silently left
it unchanged and the user's images: override was ignored. Generalize the
digest algorithm in the regex to match what Split accepts.
Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
* Address review: match OCI digest grammar and test spec example algorithms
Broaden the digest-algorithm match to the OCI grammar (algorithm components
separated by +._-), so multihash+base58 and other registered/unregistered
algorithms match, not just [a-zA-Z][a-zA-Z0-9]*. Add test cases using the
descriptor example algorithms: a full-length sha512 digest and
multihash+base58.
Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
---------
Signed-off-by: Seonghyun Hong <s3onghyun.hong@gmail.com>
* Reject paths with inner '..' in FileLoader.New to prevent silent misresolution
* Refactor hasInnerDotDot to two-phase loop eliminating mutable state
* Narrow check to embedded '..' segments to allow legitimate winding paths
* Fix gofmt alignment and trailing whitespace in new test functions
* Fix pre-existing lint errors in fileloader_test.go
* fix: performance recession when propagating namespace to helm
* fix: handle passing namespace downstream more elegant
* Revert "fix: handle passing namespace downstream more elegant"
This reverts commit 976a7cf2aa.
* Revert "fix: performance recession when propagating namespace to helm"
This reverts commit c7612d1dba.
* fix: use annotation to identify helm chart generated resources
* fix: deduplicate code
* fix: missing import in NamespaceTransformer.go
* ci: allow manual trigger of pipeline in fork
* Revert "ci: allow manual trigger of pipeline in fork"
This reverts commit 8948788fe2.
* fix: test cases
* chore: fix code comment was on wrong line
* chore: fix code comment was on wrong line pt2
* update go 1.24.6
* fix non-constant format string error
* update golang.org/x/tools@v0.36.0 and github.com/golangci/golangci-lint@v1.64.8 to pass execute golangci-lint
* add a verpose diff output to prow test
* remove pluginator binary version from generated files
* fix: Add test, when an empty patch file is given, it should not fail
* fix: Add code so there's no error given if an empty file is given as a patch
* chore: Generate plugin with pluginator
* chore: fix tests
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
* Add t.helper() at start of test function
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
---------
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
Include configuration for the new `ValidatingAdmissionPolicy` and
`ValidationAdmissionPolicyBinding` APIs so that Kustomize can natively configure
the `policyName` field in `ValidatingAdmissionPolicyBinding` with the transformed
name of `ValidatingAdmissionPolicy`.
* fix: use fmt.Errorf ubstead if non-exising `errors.New`
When https://github.com/kubernetes-sigs/kustomize/pull/5525 merged, it
referenced `errors.New` function but that function doesn't exist.
This PR replaces the call with simple `fmt.Errorf`.
* Add lint check with kustomize_disable_go_plugin_support
* move lint-api-static to /api/Makefile
* clean golangci cache
* feat: support labels key in transformer configuration
Allow the usage of a separate transformer configuration for the labels key,
similar to what is currently available for commonLabels and commonAnnotations.
This aims to provide the same functionality that commonLabels currently provide
for labels, since commonLabels is deprecated and slated for removal in a future
release.
* chore(transformerconfig): add nolint hint
Add a nolint hint to the new method so the returns can stay consistent with
one another.
* fix: changes from code review
* Rename methods `AddCommonLabelFieldSpec` and `AddLabelFieldSpec` to
`AddCommonLabelsFieldSpec` and `AddLabelsFieldSpec`.
* Add extra test to verify scenarios applying labels to Custom Resource Definitions.
