kubectl: kubectl diff doesn’t handle quoted options in KUBECTL_EXTERNAL_DIFF correctly

What happened?

I tried to make a diff ignoring lines matching a regex which includes special characters and thus has to be quoted:

KUBECTL_EXTERNAL_DIFF="diff -I\"^  generation: [0-9]\+$\"" kubectl diff -f filename.yaml

The matching line was not ignored in the output.

To get to the bottom of this I tried it with KUBECTL_EXTERNAL_DIFF="diff -Igeneration" and the matching change was successfully ignored, however when I added quotes like "diff -I\"generation\"" or 'diff -I"generation"' it failed to ignore the line.

What did you expect to happen?

kubectl diff handles the quoting correctly so that these are equivalent:

KUBECTL_EXTERNAL_DIFF="diff -Igeneration"
KUBECTL_EXTERNAL_DIFF="diff -I\"generation\""
KUBECTL_EXTERNAL_DIFF='diff -I"generation"'

It thus allows for special characters in the KUBECTL_EXTERNAL_DIFF command options.

How can we reproduce it (as minimally and precisely as possible)?

Try ignoring a change in the diff by using a quoted string inside KUBECTL_EXTERNAL_DIFF.

Anything else we need to know?

No response

Kubernetes version

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.3", GitCommit:"816c97ab8cff8a1c72eccca1026f7820e93e0d25", GitTreeState:"archive", BuildDate:"2022-01-27T18:26:18Z", GoVersion:"go1.17.6", Compiler:"gc", Platform:"linux/amd64"}

Cloud provider

Google

OS version

$ cat /etc/os-release
NAME="Arch Linux"
PRETTY_NAME="Arch Linux"
ID=arch
BUILD_ID=rolling
ANSI_COLOR="38;2;23;147;209"
HOME_URL="https://archlinux.org/"
DOCUMENTATION_URL="https://wiki.archlinux.org/"
SUPPORT_URL="https://bbs.archlinux.org/"
BUG_REPORT_URL="https://bugs.archlinux.org/"
LOGO=archlinux-logo
$ uname -a
Linux hostname 5.16.8-arch1-1 kubernetes/kubernetes#1 SMP PREEMPT Tue, 08 Feb 2022 21:21:08 +0000 x86_64 GNU/Linux

Install tools

No response

Container runtime (CRI) and and version (if applicable)

No response

Related plugins (CNI, CSI, …) and versions (if applicable)

No response

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Reactions: 1
  • Comments: 17 (7 by maintainers)

Most upvoted comments

Wow, that’s a weird and unexpected restriction when it comes to calling external programs. If security is the reason for that, shouldn’t problems like injection rather be tackled by proper string handling than by restricting user input?

I think this was originally done to avoid pulling in another dependency to handle the parsing.

@ardaguclu I took another approach in https://github.com/kubernetes/kubernetes/pull/108199 if you can take a look there.