65279bb0c2
Motivation: HelmChart.AsHelmArgs() appends ReleaseName as the first bare positional argument to `helm template`, and pullCommand() appends Name as a bare positional argument to `helm pull` (when a repo is set and the chart isn't already cached locally). Neither value is preceded by a `--` delimiter before being handed to exec.Command. Helm's own flag parser does not distinguish a bare positional argument from a flag: if a kustomization.yaml sets, for example, releaseName: --post-renderer=./evil.sh, helm interprets that as a --post-renderer flag rather than a release name, and executes the attacker-supplied script during `kustomize build --enable-helm` (or `kubectl kustomize --enable-helm`). This is a real, demonstrated flag-injection path reachable from an untrusted kustomization.yaml plus --enable-helm; it is not a claim about every possible helm argument, only the two fields that are passed as bare positionals. Other HelmChart fields (Namespace, ValuesFile, KubeVersion, etc.) are passed as `--flag value` pairs, where helm's pflag-based parser consumes the very next token as the flag's value regardless of its content, so they are not exploitable the same way and are out of scope for this change. Approach: Reject a releaseName or name that starts with '-' in validateArgs(), which runs during Config() before any helm subprocess is spawned. The check is added to the plugin source (plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator.go) and mirrored into the generated copy (api/internal/builtins/HelmChartInflationGenerator.go) via `go generate .` (pluginator), matching how this plugin is normally maintained. A small test harness helper, ErrorFromLoadAndRunGenerator, was added to api/testutils/kusttest/harnessenhanced.go, modeled on the existing ErrorFromLoadAndRunTransformer helper, so the new tests can assert on the Config()-time validation error without needing an actual helm binary installed. Validation: - `cd api && go build ./... && go vet ./...` pass. - `cd plugin/builtin/helmchartinflationgenerator && go vet ./...` passes. (`go build ./...` in that directory fails with "function main is undeclared" both before and after this change; it's a //go:generate pluginator source file compiled specially, not a standalone main package, so plain `go build` there is not meaningful.) - Added TestHelmChartInflationGeneratorRejectsFlagLikeReleaseName and TestHelmChartInflationGeneratorRejectsFlagLikeChartName in plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator_test.go. Verified both fail-then-pass: with each new HasPrefix check temporarily removed, `go test ./... -run TestHelmChartInflationGeneratorRejectsFlagLike... -v` fails with an "unable to run: helmV3 ... executable file not found" error, proving execution reaches the real helm subprocess call with the injected flag; restoring the check makes the same test pass with the expected "must not start with '-'" error, confirming validation now happens before any subprocess is spawned. - `go test ./types/... ./testutils/... ./internal/builtins/...` in api/ pass. `go test ./krusty/...` has one unrelated pre-existing failure, TestAddManagedbyLabel, which fails identically on unmodified master: it expects a version string baked in via -ldflags during `make test` that plain `go test` does not set. - golangci-lint v1.64.8 (the version pinned in hack/go.mod, matching what CI's `make lint` installs) run against the changed packages is clean. Report: https://github.com/kubernetes-sigs/kustomize/issues/6241 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Assisted-by: claude-sonnet-5 (via Claude Code)
kustomize
kustomize lets you customize raw, template-free YAML
files for multiple purposes, leaving the original YAML
untouched and usable as is.
kustomize targets kubernetes; it understands and can
patch kubernetes style API objects. It's like
make, in that what it does is declared in a file,
and it's like sed, in that it emits edited text.
This tool is sponsored by sig-cli (KEP).
kubectl integration
To find the kustomize version embedded in recent versions of kubectl, run kubectl version:
> kubectl version --client
Client Version: v1.31.0
Kustomize Version: v5.4.2
The kustomize build flow at v2.0.3 was added to kubectl v1.14. The kustomize flow in kubectl remained frozen at v2.0.3 until kubectl v1.21, which updated it to v4.0.5. It will be updated on a regular basis going forward, and such updates will be reflected in the Kubernetes release notes.
| Kubectl version | Kustomize version |
|---|---|
| < v1.14 | n/a |
| v1.14-v1.20 | v2.0.3 |
| v1.21 | v4.0.5 |
| v1.22 | v4.2.0 |
| v1.23 | v4.4.1 |
| v1.24 | v4.5.4 |
| v1.25 | v4.5.7 |
| v1.26 | v4.5.7 |
| v1.27 | v5.0.1 |
For examples and guides for using the kubectl integration please see the kubernetes documentation.
Usage
1) Make a kustomization file
In some directory containing your YAML resource files (deployments, services, configmaps, etc.), create a kustomization file.
This file should declare those resources, and any customization to apply to them, e.g. add a common label.
base: kustomization + resources
kustomization.yaml deployment.yaml service.yaml
+---------------------------------------------+ +-------------------------------------------------------+ +-----------------------------------+
| apiVersion: kustomize.config.k8s.io/v1beta1 | | apiVersion: apps/v1 | | apiVersion: v1 |
| kind: Kustomization | | kind: Deployment | | kind: Service |
| labels: | | metadata: | | metadata: |
| - includeSelectors: true | | name: myapp | | name: myapp |
| pairs: | | spec: | | spec: |
| app: myapp | | selector: | | selector: |
| resources: | | matchLabels: | | app: myapp |
| - deployment.yaml | | app: myapp | | ports: |
| - service.yaml | | template: | | - port: 6060 |
| configMapGenerator: | | metadata: | | targetPort: 6060 |
| - name: myapp-map | | labels: | +-----------------------------------+
| literals: | | app: myapp |
| - KEY=value | | spec: |
+---------------------------------------------+ | containers: |
| - name: myapp |
| image: myapp |
| resources: |
| limits: |
| memory: "128Mi" |
| cpu: "500m" |
| ports: |
| - containerPort: 6060 |
+-------------------------------------------------------+
File structure:
~/someApp ├── deployment.yaml ├── kustomization.yaml └── service.yaml
The resources in this directory could be a fork of someone else's configuration. If so, you can easily rebase from the source material to capture improvements, because you don't modify the resources directly.
Generate customized YAML with:
kustomize build ~/someApp
The YAML can be directly applied to a cluster:
kustomize build ~/someApp | kubectl apply -f -
2) Create variants using overlays
Manage traditional variants of a configuration - like development, staging and production - using overlays that modify a common base.
overlay: kustomization + patches
kustomization.yaml replica_count.yaml cpu_count.yaml
+-----------------------------------------------+ +-------------------------------+ +------------------------------------------+
| apiVersion: kustomize.config.k8s.io/v1beta1 | | apiVersion: apps/v1 | | apiVersion: apps/v1 |
| kind: Kustomization | | kind: Deployment | | kind: Deployment |
| labels: | | metadata: | | metadata: |
| - includeSelectors: true | | name: myapp | | name: myapp |
| pairs: | | spec: | | spec: |
| variant: prod | | replicas: 80 | | template: |
| resources: | +-------------------------------+ | spec: |
| - ../../base | | containers: |
| patches: | | - name: myapp |
| - path: replica_count.yaml | | resources: |
| - path: cpu_count.yaml | | limits: |
+-----------------------------------------------+ | memory: "128Mi" |
| cpu: "7000m" |
+------------------------------------------+
File structure:
~/someApp ├── base │ ├── deployment.yaml │ ├── kustomization.yaml │ └── service.yaml └── overlays ├── development │ ├── cpu_count.yaml │ ├── kustomization.yaml │ └── replica_count.yaml └── production ├── cpu_count.yaml ├── kustomization.yaml └── replica_count.yaml
Take the work from step (1) above, move it into a
someApp subdirectory called base, then
place overlays in a sibling directory.
An overlay is just another kustomization, referring to the base, and referring to patches to apply to that base.
This arrangement makes it easy to manage your
configuration with git. The base could have files
from an upstream repository managed by someone else.
The overlays could be in a repository you own.
Arranging the repo clones as siblings on disk avoids
the need for git submodules (though that works fine, if
you are a submodule fan).
Generate YAML with
kustomize build ~/someApp/overlays/production
The YAML can be directly applied to a cluster:
kustomize build ~/someApp/overlays/production | kubectl apply -f -
Community
Code of conduct
Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.