(github.com)

171 points irke882 | 2 comments | 09 Jul 25 05:49 UTC | HN request time: 0.411s | source

Show context

ivan4th ◴[09 Jul 25 12:23 UTC] No.44509174[source]▶

Helm is an abomination, as the whole idea of using a text template engine to generate YAML is. And this vulnerability adds insult to injury ;)

Sorry, just can't really recover from trauma of counting spaces and messing up newlines, etc. when writing Helm templates. You know, Lisp "sucks" because "you need to count parenthesis" (you actually don't), yet Helm is a widely accepted technology where you need to count spaces for (n)indent ;)

replies(5): >>44511394 #>>44512692 #>>44512702 #>>44515521 #>>44516363 #

1. akvadrako ◴[10 Jul 25 01:30 UTC] No.44516363[source]▶

>>44509174 #

Something like kustomize was a better approach, where resources are templates semantically.

Though it's lacking in several ways, like good destroy functionality.

replies(1): >>44531236 #

2. moondev ◴[11 Jul 25 12:12 UTC] No.44531236[source]▶

>>44516363 (TP) #

I like wrapping with kapp for this. However kustomize still skips hooks if you inflate a chart that uses them and there is value in discoverability of helm apps installed with clear versioning

      kustomize build | kapp deploy -a my-app -y -f -

↑

Helm local code execution via a malicious chart