Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Make dry-run=server optional #499

Merged
merged 2 commits into from
Jan 9, 2024
Merged

fix: Make dry-run=server optional #499

merged 2 commits into from
Jan 9, 2024

Commits on Jan 4, 2024

  1. fix: Make dry-run=server optional 

    This intends to fix a potential security issue introduced via #458 before
cutting the next helm-diff release.

Since #458 (unreleased), we had forced helm-diff to use `helm template --dry-run=server` for Helm 3.13 or greater.

I think this can create an unintended security hole, where any users, who can run
helm-diff via CI or any automation with an arbitrary chart and values, is able
to view cluster resources via helm template's `lookup` functions.

Previously this was impossible because `helm template` run by `helm diff` had
no access to the `lookup` function. To fix this, we need to make `--dry-run=server`
optional. And we do so by introducing a new flag `--dry-run=[|client|server]` to helm-diff.

See the updated README and the updated helm-diff help message for more details.
    @mumoshu
    mumoshu committed Jan 4, 2024
    Configuration menu
    Copy the full SHA
    0a9777c View commit details
    Browse the repository at this point in the history

  2. Fix broken flag parsing

    @mumoshu
    mumoshu committed Jan 4, 2024
    Configuration menu
    Copy the full SHA
    94c0f4e View commit details
    Browse the repository at this point in the history