Escape $ as $$ in Kubernetes env var values to prevent $(VAR) expansion

Ashvin Sharmarequested to merge
fix/issue-39349-escape-dollar-in-k8s-env-vars into main

What does this MR do?

Escapes $ as $$ in all CI/CD variable values written to api.EnvVar.Value in the Kubernetes executor's buildVariables() function.

Kubernetes applies $(VAR_NAME) substitution to environment variable values in a Pod spec. Without escaping, any variable value containing a $ sign (e.g. passwords like p@$$word, regexes, or shell snippets) is silently expanded — or garbled — before it reaches the job. Kubernetes treats $$ as a literal $, so escaping $ → $$ ensures the value reaching the job is correct.

Why was this MR needed?

The Kubernetes executor was the only executor that silently modified variable values containing $. This is especially dangerous for secrets and tokens. The fix is a single strings.ReplaceAll(b.Value, "$", "$$") call in buildVariables() in executors/kubernetes/util.go.

Root cause: buildVariables() passed values directly to api.EnvVar.Value without escaping $. Kubernetes interprets $(FOO) in env var values as a reference to another env var in the same pod spec.

Reference: https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/

What's the best way to test this MR?

Run the unit tests:

go test -count=1 ./executors/kubernetes/... -run "TestBuildVariables"

The new TestBuildVariablesDollarEscaping table-driven test covers all acceptance criteria cases:

  • $FOO → $$FOO
  • $(FOO) → $$(FOO)
  • $$ → $$$$
  • p@$$word → p@$$$$word
  • Plain values without $ are unchanged

What are the relevant issue numbers?

Closes #39349 (closed)

Merge request reports