Function execInPod

shell/trace.go:158–204

execInPod executes a command inside a pod container without using a shell. SECURITY: The command is passed as an array directly to the container runtime, preventing shell injection attacks. No shell interpolation occurs. Parameters: - ctx: Context for cancellation (e.g., Ctrl-C) - restConfig: Kuber

(
	ctx context.Context,
	restConfig *rest.Config,
	clientset *kubernetes.Clientset,
	namespace, podName, containerName string,
	command []string,
	stdout, stderr io.Writer,
)

//   - stdout: Writer for stdout (typically os.Stdout)
//   - stderr: Writer for stderr (typically os.Stderr)
func execInPod(
	ctx context.Context,
	restConfig *rest.Config,
	clientset *kubernetes.Clientset,
	namespace, podName, containerName string,
	command []string,
	stdout, stderr io.Writer,
) error {
	// Build the exec request using the REST API directly
	// SECURITY: Command is passed as array in PodExecOptions, NOT through a shell
	req := clientset.CoreV1().RESTClient().
		Post().
		Resource("pods").
		Name(podName).
		Namespace(namespace).
		SubResource("exec").
		VersionedParams(&v1.PodExecOptions{
			Container: containerName,
			Command:   command, // Direct command array - no shell!
			Stdin:     false,
			Stdout:    true,
			Stderr:    true,
			TTY:       false,
		}, scheme.ParameterCodec)

	// Create the SPDY executor
	exec, err := remotecommand.NewSPDYExecutor(restConfig, "POST", req.URL())
	if err != nil {
		return fmt.Errorf("error creating executor: %w", err)
	}

	// Stream the output
	// The Stream function blocks until the command completes or context is cancelled
	err = exec.StreamWithContext(ctx, remotecommand.StreamOptions{
		Stdout: stdout,
		Stderr: stderr,
	})
	if err != nil {
		// Check if it was a context cancellation (user pressed Ctrl-C)
		if ctx.Err() != nil {
			return fmt.Errorf("context error: %w", ctx.Err())
		}
		return fmt.Errorf("error streaming command output: %w", err)
	}

	return nil
}

// hostNetworkPodForTrace creates a pod manifest for network tracing.
// The pod runs with host network and required capabilities for bpftrace.