Motivation:
HelmChart.AsHelmArgs() appends ReleaseName as the first bare
positional argument to `helm template`, and pullCommand() appends
Name as a bare positional argument to `helm pull` (when a repo is
set and the chart isn't already cached locally). Neither value is
preceded by a `--` delimiter before being handed to exec.Command.
Helm's own flag parser does not distinguish a bare positional
argument from a flag: if a kustomization.yaml sets, for example,
releaseName: --post-renderer=./evil.sh, helm interprets that as a
--post-renderer flag rather than a release name, and executes the
attacker-supplied script during `kustomize build --enable-helm`
(or `kubectl kustomize --enable-helm`). This is a real,
demonstrated flag-injection path reachable from an untrusted
kustomization.yaml plus --enable-helm; it is not a claim about
every possible helm argument, only the two fields that are passed
as bare positionals. Other HelmChart fields (Namespace, ValuesFile,
KubeVersion, etc.) are passed as `--flag value` pairs, where helm's
pflag-based parser consumes the very next token as the flag's value
regardless of its content, so they are not exploitable the same way
and are out of scope for this change.
Approach:
Reject a releaseName or name that starts with '-' in validateArgs(),
which runs during Config() before any helm subprocess is spawned.
The check is added to the plugin source
(plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator.go)
and mirrored into the generated copy
(api/internal/builtins/HelmChartInflationGenerator.go) via
`go generate .` (pluginator), matching how this plugin is normally
maintained. A small test harness helper,
ErrorFromLoadAndRunGenerator, was added to
api/testutils/kusttest/harnessenhanced.go, modeled on the existing
ErrorFromLoadAndRunTransformer helper, so the new tests can assert
on the Config()-time validation error without needing an actual
helm binary installed.
Validation:
- `cd api && go build ./... && go vet ./...` pass.
- `cd plugin/builtin/helmchartinflationgenerator && go vet ./...`
passes. (`go build ./...` in that directory fails with "function
main is undeclared" both before and after this change; it's a
//go:generate pluginator source file compiled specially, not a
standalone main package, so plain `go build` there is not
meaningful.)
- Added TestHelmChartInflationGeneratorRejectsFlagLikeReleaseName
and TestHelmChartInflationGeneratorRejectsFlagLikeChartName in
plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator_test.go.
Verified both fail-then-pass: with each new HasPrefix check
temporarily removed, `go test ./... -run
TestHelmChartInflationGeneratorRejectsFlagLike... -v` fails with
an "unable to run: helmV3 ... executable file not found" error,
proving execution reaches the real helm subprocess call with the
injected flag; restoring the check makes the same test pass with
the expected "must not start with '-'" error, confirming
validation now happens before any subprocess is spawned.
- `go test ./types/... ./testutils/... ./internal/builtins/...` in
api/ pass. `go test ./krusty/...` has one unrelated pre-existing
failure, TestAddManagedbyLabel, which fails identically on
unmodified master: it expects a version string baked in via
-ldflags during `make test` that plain `go test` does not set.
- golangci-lint v1.64.8 (the version pinned in hack/go.mod, matching
what CI's `make lint` installs) run against the changed packages
is clean.
Report: https://github.com/kubernetes-sigs/kustomize/issues/6241
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5 (via Claude Code)
Updates k8s.io/kube-openapi from v0.0.0-20241212222426-2c72e554b1e7 to
v0.0.0-20260502001324-b7f5293f4787 across api, kyaml, and kustomize modules,
then propagates the change across all workspace modules via make workspace-sync.
The new kube-openapi release switched from the monolithic go-openapi/swag
(v0.23.0) to the refactored split sub-modules (go-openapi/swag/* v0.25.4).
The old swag carried github.com/mailru/easyjson as a dependency; the new
sub-modules do not. After go mod tidy, easyjson and josharian/intern are
fully removed from all three module graphs.
Also upgraded: github.com/google/gnostic-models v0.6.9 → v0.7.0 (pulled
in by the same kube-openapi update).
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
The github.com/pkg/errors package is unmaintained and archived.
It was pulled in as a transitive dependency through json-patch v4.12.0.
Upgrading to v4.13.0 removes this dependency while maintaining API
compatibility.
json-patch commit: evanphx/json-patch@106306d
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
* fix: performance recession when propagating namespace to helm
* fix: handle passing namespace downstream more elegant
* Revert "fix: handle passing namespace downstream more elegant"
This reverts commit 976a7cf2aa.
* Revert "fix: performance recession when propagating namespace to helm"
This reverts commit c7612d1dba.
* fix: use annotation to identify helm chart generated resources
* fix: deduplicate code
* fix: missing import in NamespaceTransformer.go
* ci: allow manual trigger of pipeline in fork
* Revert "ci: allow manual trigger of pipeline in fork"
This reverts commit 8948788fe2.
* fix: test cases
* chore: fix code comment was on wrong line
* chore: fix code comment was on wrong line pt2
* update go 1.24.6
* fix non-constant format string error
* update golang.org/x/tools@v0.36.0 and github.com/golangci/golangci-lint@v1.64.8 to pass execute golangci-lint
* add a verpose diff output to prow test
* remove pluginator binary version from generated files
* fix: Add test, when an empty patch file is given, it should not fail
* fix: Add code so there's no error given if an empty file is given as a patch
* chore: Generate plugin with pluginator
* chore: fix tests
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
* Add t.helper() at start of test function
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
---------
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
This includes the go-difflib and go-spew reverts, which means the
corresponding exclusions can be removed. cmd/gorepomod/go.mod loses a
number of indirect dependencies thanks to the spf13/viper cleanup, but
hack/go.mod gains a few.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
* workspace sync
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* downgrade go-difflib and go-spew to tagged releases
commit d35edbf80d updated these dependencies
to untagged versions. The diff in both dependencies show that there's no
code changes, and it's unlikely for those modules to do new releases.
Unfortunate, because of that change all projects depending on kubernetes
or any of it's modules now had to upgrade to unreleased versions of
these.
This patch reverts those updates (but it may take some time before
all other projects can be reverted).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---------
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
