Fix CVE-2024-25620

This is done by detaching pilot from helm.sh/helm/v3.

Signed-off-by: Dhi Aurrahman <[email protected]>

Author: dio

operator/pkg/name/name.go

@@ -20,7 +20,6 @@ import (
 
 	"istio.io/api/operator/v1alpha1"
 	iop "istio.io/istio/operator/pkg/apis/istio/v1alpha1"
-	"istio.io/istio/operator/pkg/helm"
 	"istio.io/istio/operator/pkg/tpath"
 )
 
@@ -85,6 +84,11 @@ const (
 	InstalledSpecCRPrefix = "installed-state"
 )
 
+const (
+	// YAMLSeparator is a separator for multi-document YAML files.
+	YAMLSeparator = "\n---\n"
+)
+
 // ComponentName is a component name string, typed to constrain allowed values.
 type ComponentName string
 
@@ -173,7 +177,7 @@ func (mm ManifestMap) Consolidated() map[string]string {
 	for cname, ms := range mm {
 		allM := ""
 		for _, m := range ms {
-			allM += m + helm.YAMLSeparator
+			allM += m + YAMLSeparator
 		}
 		out[string(cname)] = allM
 	}
@@ -182,15 +186,15 @@ func (mm ManifestMap) Consolidated() map[string]string {
 
 // MergeManifestSlices merges a slice of manifests into a single manifest string.
 func MergeManifestSlices(manifests []string) string {
-	return strings.Join(manifests, helm.YAMLSeparator)
+	return strings.Join(manifests, YAMLSeparator)
 }
 
 // String implements the Stringer interface.
 func (mm ManifestMap) String() string {
 	out := ""
 	for _, ms := range mm {
 		for _, m := range ms {
-			out += m + helm.YAMLSeparator
+			out += m + YAMLSeparator
 		}
 	}
 	return out

operator/pkg/object/objects.go

@@ -32,7 +32,6 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"istio.io/istio/operator/pkg/apis/istio/v1alpha1"
-	"istio.io/istio/operator/pkg/helm"
 	names "istio.io/istio/operator/pkg/name"
 	"istio.io/istio/operator/pkg/tpath"
 	"istio.io/istio/operator/pkg/util"
@@ -231,7 +230,7 @@ func (os K8sObjects) String() string {
 	for _, oo := range os {
 		out = append(out, oo.YAMLDebugString())
 	}
-	return strings.Join(out, helm.YAMLSeparator)
+	return strings.Join(out, YAMLSeparator)
 }
 
 // Keys returns a slice with the keys of os.

pkg/revisions/tag_watcher.go

@@ -19,7 +19,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	"istio.io/api/label"
-	"istio.io/istio/istioctl/pkg/tag"
 	"istio.io/istio/pkg/kube"
 	"istio.io/istio/pkg/kube/controllers"
 	"istio.io/istio/pkg/kube/kclient"
@@ -28,6 +27,8 @@ import (
 	"istio.io/pkg/log"
 )
 
+const IstioTagLabel = "istio.io/tag"
+
 // TagWatcher keeps track of the current tags and can notify watchers
 // when the tags change.
 type TagWatcher interface {
@@ -93,7 +94,7 @@ func (p *tagWatcher) HasSynced() bool {
 func (p *tagWatcher) GetMyTags() sets.String {
 	res := sets.New(p.revision)
 	for _, wh := range p.index.Lookup(p.revision) {
-		res.Insert(wh.GetLabels()[tag.IstioTagLabel])
+		res.Insert(wh.GetLabels()[IstioTagLabel])
 	}
 	return res
 }
@@ -111,6 +112,6 @@ func isTagWebhook(uobj any) bool {
 	if !ok {
 		return false
 	}
-	_, ok = obj.GetLabels()[tag.IstioTagLabel]
+	_, ok = obj.GetLabels()[IstioTagLabel]
 	return ok
 }