Skip to content

Commit f8babb8

Browse files
tsahiduektsahiduek
authored
fix(eks): malformed command when installing helm chart from OCI artifact (#19778)
When using helm to pull OCI artifacts, the helm pull command doesn't works well. The [check_output](https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess) uses shell=True. That means that all arguments of the commands being passed to the check_output are basically been passed to the shell and not to the helm pull command. Using shell is also discouraged from [security perspective](https://docs.python.org/3/library/subprocess.html#security-considerations) References: https://docs.python.org/3/library/subprocess.html > On POSIX with shell=True, the shell defaults to /bin/sh. If args is a string, the string specifies the command to execute through the shell. This means that the string must be formatted exactly as it would be when typed at the shell prompt. This includes, for example, quoting or backslash escaping filenames with spaces in them. If args is a sequence, the first item specifies the command string, and any additional items will be treated as additional arguments to the shell itself. https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess The previous change that used the `Shell=True` was introduced in commit - #18547 (comment) EDIT: Adding commit for the following items: - Adding integration test for helm OCI support in aws-eks - Upgrading helm version to 3.8.1 in `aws-lambda-layer` because of issues with the current version of helm that is been used, for OCI chart supports - update `integ.eks-helm-asset.expected.json` file ---- ### All Submissions: * [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md/#adding-new-unconventional-dependencies) - NO new unconventional dependencies ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/master/INTEGRATION_TESTS.md)? - NO * [ ] Did you use `cdk-integ` to deploy the infrastructure and generate the snapshot (i.e. `cdk-integ` without `--dry-run`)? - NO *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent f82d96b commit f8babb8

File tree

4 files changed

+72
-32
lines changed

4 files changed

+72
-32
lines changed

‎packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ def get_oci_cmd(repository, version):
108108
]
109109
else:
110110
logger.info("Non AWS OCI repository found")
111-
cmnd = ['HELM_EXPERIMENTAL_OCI=1', 'helm', 'pull', repository, '--version', version, '--untar']
111+
cmnd = ['helm', 'pull', repository, '--version', version, '--untar']
112112

113113
return cmnd
114114

@@ -123,7 +123,7 @@ def get_chart_from_oci(tmpdir, release, repository = None, version = None):
123123
try:
124124
logger.info(cmnd)
125125
env = get_env_with_oci_flag()
126-
output = subprocess.check_output(cmnd, stderr=subprocess.STDOUT, cwd=tmpdir, env=env, shell=True)
126+
output = subprocess.check_output(cmnd, stderr=subprocess.STDOUT, cwd=tmpdir, env=env)
127127
logger.info(output)
128128

129129
return os.path.join(tmpdir, release)

‎packages/@aws-cdk/aws-eks/test/integ.eks-helm-asset.expected.json

+60-29
Original file line numberDiff line numberDiff line change
@@ -1075,6 +1075,37 @@
10751075
"UpdateReplacePolicy": "Delete",
10761076
"DeletionPolicy": "Delete"
10771077
},
1078+
"Clustercharttestocichart9C188967": {
1079+
"Type": "Custom::AWSCDK-EKS-HelmChart",
1080+
"Properties": {
1081+
"ServiceToken": {
1082+
"Fn::GetAtt": [
1083+
"awscdkawseksKubectlProviderNestedStackawscdkawseksKubectlProviderNestedStackResourceA7AEBA6B",
1084+
"Outputs.awscdkekshelmtestawscdkawseksKubectlProviderframeworkonEvent9D93C644Arn"
1085+
]
1086+
},
1087+
"ClusterName": {
1088+
"Ref": "Cluster9EE0221C"
1089+
},
1090+
"RoleArn": {
1091+
"Fn::GetAtt": [
1092+
"ClusterCreationRole360249B6",
1093+
"Arn"
1094+
]
1095+
},
1096+
"Release": "s3-chart",
1097+
"Chart": "s3-chart",
1098+
"Version": "v0.0.19",
1099+
"Namespace": "ack-system",
1100+
"Repository": "oci://public.ecr.aws/aws-controllers-k8s/s3-chart",
1101+
"CreateNamespace": true
1102+
},
1103+
"DependsOn": [
1104+
"ClusterKubectlReadyBarrier200052AF"
1105+
],
1106+
"UpdateReplacePolicy": "Delete",
1107+
"DeletionPolicy": "Delete"
1108+
},
10781109
"awscdkawseksClusterResourceProviderNestedStackawscdkawseksClusterResourceProviderNestedStackResource9827C454": {
10791110
"Type": "AWS::CloudFormation::Stack",
10801111
"Properties": {
@@ -1171,7 +1202,7 @@
11711202
},
11721203
"/",
11731204
{
1174-
"Ref": "AssetParameters6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0S3Bucket4C69A575"
1205+
"Ref": "AssetParameters0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289efS3Bucket2C1AF85C"
11751206
},
11761207
"/",
11771208
{
@@ -1181,7 +1212,7 @@
11811212
"Fn::Split": [
11821213
"||",
11831214
{
1184-
"Ref": "AssetParameters6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0S3VersionKeyCD3DAD60"
1215+
"Ref": "AssetParameters0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289efS3VersionKey27D35864"
11851216
}
11861217
]
11871218
}
@@ -1194,7 +1225,7 @@
11941225
"Fn::Split": [
11951226
"||",
11961227
{
1197-
"Ref": "AssetParameters6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0S3VersionKeyCD3DAD60"
1228+
"Ref": "AssetParameters0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289efS3VersionKey27D35864"
11981229
}
11991230
]
12001231
}
@@ -1219,11 +1250,11 @@
12191250
"referencetoawscdkekshelmtestAssetParametersd65fbdc11b108e0386ed8577c454d4544f6d4e7960f84a0d2e211478d6324dbfS3Bucket5EAB45FARef": {
12201251
"Ref": "AssetParametersd65fbdc11b108e0386ed8577c454d4544f6d4e7960f84a0d2e211478d6324dbfS3BucketBFD29DFB"
12211252
},
1222-
"referencetoawscdkekshelmtestAssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8S3BucketC59436A3Ref": {
1223-
"Ref": "AssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8S3Bucket4CD5FFC3"
1253+
"referencetoawscdkekshelmtestAssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963S3BucketEC27A5F2Ref": {
1254+
"Ref": "AssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963S3Bucket9BDF5881"
12241255
},
1225-
"referencetoawscdkekshelmtestAssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8S3VersionKey5ECB4296Ref": {
1226-
"Ref": "AssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8S3VersionKeyE06BA291"
1256+
"referencetoawscdkekshelmtestAssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963S3VersionKey5772F015Ref": {
1257+
"Ref": "AssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963S3VersionKey63AC53A2"
12271258
},
12281259
"referencetoawscdkekshelmtestVpcPrivateSubnet1Subnet3D2B5C0BRef": {
12291260
"Ref": "VpcPrivateSubnet1Subnet536B997A"
@@ -1246,11 +1277,11 @@
12461277
"referencetoawscdkekshelmtestAssetParameters92c405c4551a308bcdd55823f8b16268bd3c38fd2a011edaaf3ed72a80f557c4S3VersionKey149985B9Ref": {
12471278
"Ref": "AssetParameters92c405c4551a308bcdd55823f8b16268bd3c38fd2a011edaaf3ed72a80f557c4S3VersionKeyEF78B2AD"
12481279
},
1249-
"referencetoawscdkekshelmtestAssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eS3Bucket355FB348Ref": {
1250-
"Ref": "AssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eS3BucketD3288998"
1280+
"referencetoawscdkekshelmtestAssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket8229D3A2Ref": {
1281+
"Ref": "AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket83B8778F"
12511282
},
1252-
"referencetoawscdkekshelmtestAssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eS3VersionKeyA7F169F4Ref": {
1253-
"Ref": "AssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eS3VersionKeyB00C0565"
1283+
"referencetoawscdkekshelmtestAssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3VersionKey0C91EE3ERef": {
1284+
"Ref": "AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3VersionKeyADF6A055"
12541285
},
12551286
"referencetoawscdkekshelmtestAssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3Bucket0A18730ERef": {
12561287
"Ref": "AssetParameters5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391S3BucketB4102E9A"
@@ -1351,17 +1382,17 @@
13511382
"Type": "String",
13521383
"Description": "Artifact hash for asset \"5b47c8e4cbbce7e4a8085f1aa83ed9c4691b7f65927ba092d6620bbba925f391\""
13531384
},
1354-
"AssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8S3Bucket4CD5FFC3": {
1385+
"AssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963S3Bucket9BDF5881": {
13551386
"Type": "String",
1356-
"Description": "S3 bucket for asset \"a70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8\""
1387+
"Description": "S3 bucket for asset \"07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963\""
13571388
},
1358-
"AssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8S3VersionKeyE06BA291": {
1389+
"AssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963S3VersionKey63AC53A2": {
13591390
"Type": "String",
1360-
"Description": "S3 key for asset version \"a70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8\""
1391+
"Description": "S3 key for asset version \"07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963\""
13611392
},
1362-
"AssetParametersa70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8ArtifactHashA4AB6609": {
1393+
"AssetParameters07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963ArtifactHash41646C3F": {
13631394
"Type": "String",
1364-
"Description": "Artifact hash for asset \"a70c48e7047fb793b2378668accb1dc2d92f2d7b1fff80c9c718f4964dc69cb8\""
1395+
"Description": "Artifact hash for asset \"07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963\""
13651396
},
13661397
"AssetParameters92c405c4551a308bcdd55823f8b16268bd3c38fd2a011edaaf3ed72a80f557c4S3BucketC479E94B": {
13671398
"Type": "String",
@@ -1375,17 +1406,17 @@
13751406
"Type": "String",
13761407
"Description": "Artifact hash for asset \"92c405c4551a308bcdd55823f8b16268bd3c38fd2a011edaaf3ed72a80f557c4\""
13771408
},
1378-
"AssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eS3BucketD3288998": {
1409+
"AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket83B8778F": {
13791410
"Type": "String",
1380-
"Description": "S3 bucket for asset \"ea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03e\""
1411+
"Description": "S3 bucket for asset \"c6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffed\""
13811412
},
1382-
"AssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eS3VersionKeyB00C0565": {
1413+
"AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3VersionKeyADF6A055": {
13831414
"Type": "String",
1384-
"Description": "S3 key for asset version \"ea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03e\""
1415+
"Description": "S3 key for asset version \"c6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffed\""
13851416
},
1386-
"AssetParametersea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03eArtifactHash4654D012": {
1417+
"AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedArtifactHash2C972BAF": {
13871418
"Type": "String",
1388-
"Description": "Artifact hash for asset \"ea17febe6d04c66048f3e8e060c71685c0cb53122abceff44842d27bc0d4a03e\""
1419+
"Description": "Artifact hash for asset \"c6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffed\""
13891420
},
13901421
"AssetParametersd65fbdc11b108e0386ed8577c454d4544f6d4e7960f84a0d2e211478d6324dbfS3BucketBFD29DFB": {
13911422
"Type": "String",
@@ -1411,17 +1442,17 @@
14111442
"Type": "String",
14121443
"Description": "Artifact hash for asset \"8da8ef613cd1b5a7cebfe44577f36e7ab0b4b00b97a7789401a48c80b78f0852\""
14131444
},
1414-
"AssetParameters6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0S3Bucket4C69A575": {
1445+
"AssetParameters0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289efS3Bucket2C1AF85C": {
14151446
"Type": "String",
1416-
"Description": "S3 bucket for asset \"6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0\""
1447+
"Description": "S3 bucket for asset \"0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289ef\""
14171448
},
1418-
"AssetParameters6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0S3VersionKeyCD3DAD60": {
1449+
"AssetParameters0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289efS3VersionKey27D35864": {
14191450
"Type": "String",
1420-
"Description": "S3 key for asset version \"6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0\""
1451+
"Description": "S3 key for asset version \"0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289ef\""
14211452
},
1422-
"AssetParameters6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0ArtifactHashBF9C53E1": {
1453+
"AssetParameters0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289efArtifactHash9EB43449": {
14231454
"Type": "String",
1424-
"Description": "Artifact hash for asset \"6d85f035a38de5e5a2362ad891388f472b5d63327246684c8979b718f2ff3dc0\""
1455+
"Description": "Artifact hash for asset \"0f0fca85b345e05ce2d9856ebaef0bec86a728074139a71a31b68c96b20289ef\""
14251456
}
14261457
}
14271458
}

‎packages/@aws-cdk/aws-eks/test/integ.eks-helm-asset.ts

+9
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,15 @@ class EksClusterStack extends Stack {
4747
this.cluster.addHelmChart('test-chart', {
4848
chartAsset: chartAsset,
4949
});
50+
51+
this.cluster.addHelmChart('test-oci-chart', {
52+
chart: 's3-chart',
53+
release: 's3-chart',
54+
repository: 'oci://public.ecr.aws/aws-controllers-k8s/s3-chart',
55+
version: 'v0.0.19',
56+
namespace: 'ack-system',
57+
createNamespace: true,
58+
});
5059
}
5160
}
5261

‎packages/@aws-cdk/lambda-layer-kubectl/layer/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ FROM public.ecr.aws/lambda/provided:latest
88
# KUBECTL_VERSION should not be changed at the moment, see https://github.com/aws/aws-cdk/issues/15736
99
# Version 1.21.0 is not compatible with version 1.20 (and lower) of the server.
1010
ARG KUBECTL_VERSION=1.20.0
11-
ARG HELM_VERSION=3.5.4
11+
ARG HELM_VERSION=3.8.1
1212

1313
USER root
1414
RUN mkdir -p /opt

0 commit comments

Comments
 (0)