fix: convert kubectl port-forward execution to shell:false

Signed-off-by: Fantomasa <ivailoinfo@gmail.com>

Author: Fantomasa

src/integration/kube/k8-client/resources/pod/k8-client-pod.ts

@@ -254,7 +254,7 @@ export class K8ClientPod implements Pod {
         // WSL2 has issues with kubectl port-forward when binding to localhost, binding to all interfaces will trigger
         // a permission prompt which if hidden behind the terminal can cause the port-forward command to fail.
         if (!isWindows) {
-          cmdArguments.push(localBindAddress, '&');
+          cmdArguments.push(localBindAddress);
         }
       } else {
         cmd = constants.KUBECTL;
@@ -280,16 +280,14 @@ export class K8ClientPod implements Pod {
         }
       }
 
-      // Don't use shell on Windows when doing persist mode to avoid argument parsing issues
-      const useShell: boolean = isWindows && persist ? false : true;
-
+      // shell:false to eliminate shell-injection; ShellRunner's detached spawn handles backgrounding.
       await new ShellRunner().run(cmd, cmdArguments, {
         verbose: true,
         detached: true,
         environmentVariablesToAppend: {
           PATH: `${this.kubectlInstallationDirectory}${path.delimiter}${process.env.PATH}`,
         },
-        useShell,
+        useShell: false,
       });
 
       return availablePort;
@@ -338,6 +336,15 @@ export class K8ClientPod implements Pod {
     return matchedProcesses;
   }
 
+  // Best-effort: signal the process group led by pid (detached forwards are group leaders); ignore if not a leader.
+  private static killProcessGroup(pid: number, signal: NodeJS.Signals): void {
+    try {
+      process.kill(-pid, signal);
+    } catch {
+      // not a group leader (or already exited); the direct process.kill(pid) call handles it
+    }
+  }
+
   public async stopPortForward(port: number): Promise<void> {
     if (!port) {
       return;
@@ -364,6 +371,8 @@ export class K8ClientPod implements Pod {
       // Extract PIDs and kill the processes
       for (const pid of matchedProcesses.map((p: ProcessInfo): number => p.pid)) {
         try {
+          // Signal the whole detached process group so no orphaned kubectl child keeps the local port. #4953
+          K8ClientPod.killProcessGroup(pid, 'SIGTERM');
           process.kill(pid, 'SIGTERM');
           this.logger.debug(`Successfully sent SIGTERM to PID: ${pid}`);
 
@@ -376,6 +385,7 @@ export class K8ClientPod implements Pod {
             this.logger.debug(
               `Process with PID ${pid} is still running after SIGTERM, attempting to kill with SIGKILL`,
             );
+            K8ClientPod.killProcessGroup(pid, 'SIGKILL');
             process.kill(pid, 'SIGKILL');
           }
         } catch (killError) {