crossplane-contrib / function-go-templating

A Go templating composition function
https://crossplane.io
Apache License 2.0
52 stars 33 forks source link

Remove sprig's env and expandenv functions #68

Closed jake-ciolek closed 2 months ago

jake-ciolek commented 8 months ago

Both Helm and ArgoCD remove access to these two due to security implications. It's possible to retrieve the function's pod environmental values. Some of these might be sensitive.

See more:

https://masterminds.github.io/sprig/os.html https://github.com/argoproj/argo-workflows/pull/5850 https://github.com/helm/helm/blob/e81f6140ddb22bc99a08f7409522a8dbe5338ee3/pkg/engine/funcs.go#L45

Also ran a go fmt.

Description of your changes

Fixes #67

I have: