Fix CVE-2024-25620

This is done by detaching pilot from helm.sh/helm/v3.

Signed-off-by: Dhi Aurrahman <[email protected]>

operator/pkg/name/name.go

@@ -20,7 +20,6 @@ import (
 
 	"istio.io/api/operator/v1alpha1"
 	iop "istio.io/istio/operator/pkg/apis/istio/v1alpha1"
-	"istio.io/istio/operator/pkg/helm"
 	"istio.io/istio/operator/pkg/tpath"
 )
 
@@ -85,6 +84,11 @@ const (
 	InstalledSpecCRPrefix = "installed-state"
 )
 
+const (
+	// YAMLSeparator is a separator for multi-document YAML files.
+	YAMLSeparator = "\n---\n"
+)
+
 // ComponentName is a component name string, typed to constrain allowed values.
 type ComponentName string
 
@@ -173,7 +177,7 @@ func (mm ManifestMap) Consolidated() map[string]string {
 	for cname, ms := range mm {
 		allM := ""
 		for _, m := range ms {
-			allM += m + helm.YAMLSeparator
+			allM += m + YAMLSeparator
 		}
 		out[string(cname)] = allM
 	}
@@ -182,15 +186,15 @@ func (mm ManifestMap) Consolidated() map[string]string {
 
 // MergeManifestSlices merges a slice of manifests into a single manifest string.
 func MergeManifestSlices(manifests []string) string {
-	return strings.Join(manifests, helm.YAMLSeparator)
+	return strings.Join(manifests, YAMLSeparator)
 }
 
 // String implements the Stringer interface.
 func (mm ManifestMap) String() string {
 	out := ""
 	for _, ms := range mm {
 		for _, m := range ms {
-			out += m + helm.YAMLSeparator
+			out += m + YAMLSeparator
 		}
 	}
 	return out

operator/pkg/object/objects.go

@@ -32,7 +32,6 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"istio.io/istio/operator/pkg/apis/istio/v1alpha1"
-	"istio.io/istio/operator/pkg/helm"
 	names "istio.io/istio/operator/pkg/name"
 	"istio.io/istio/operator/pkg/tpath"
 	"istio.io/istio/operator/pkg/util"
@@ -231,7 +230,7 @@ func (os K8sObjects) String() string {
 	for _, oo := range os {
 		out = append(out, oo.YAMLDebugString())
 	}
-	return strings.Join(out, helm.YAMLSeparator)
+	return strings.Join(out, YAMLSeparator)
 }
 
 // Keys returns a slice with the keys of os.