safely deserialize k8 yaml

[anthonywoo]

Note: Samson is a public repo, do not include Zendesk-internal information, urls, etc.

Using YAML.load_stream is unsafe and allows instantiating arbitrary classes which may lead to remote code execution (RCE)

I had to use multiple streams because Samson needs to support multiple documents in a single yaml file

References

• Jira link:

Risks

• Medium? Some k8 deploys may fail if it is using a disallowed class